---
title: "Polar Webhook"
method: POST
path: "/api/v1/billing/webhook"
tags: ["billing"]
---

# Polar Webhook

`POST /api/v1/billing/webhook`

## Request

- Base URL: `https://api.cohearence.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.cohearence.app/api/v1/billing/webhook`
- Auth: none declared

Receive Polar webhooks — ``customer.state_changed`` only.

That event carries the customer's complete state (subscriptions, benefits, meters)
rather than a diff, which makes the handler idempotent and immune to redelivery.

Acks immediately and does the DB write in a background task: Polar times out at 10
seconds and **disables an endpoint after 10 consecutive non-2xx responses**, with no
dead-letter queue and no replay. So anything that is not "this request was forged"
still returns 200 — a parse failure we can investigate in logs beats a disabled
endpoint we discover a week later.

Deliberately unauthenticated: the Standard Webhooks signature *is* the authentication.

## Response `200`

Successful Response

- object

---

[API](https://skmtc.dev/cohearence/apis/health-agent-api.md) · [All operations](https://skmtc.dev/cohearence/apis/health-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cohearence/apis/health-agent-api/revisions/c7aee7d6ecf0?raw)