---
title: "DePix received without a matching checkout"
method: POST
path: "checkout.unmatched_payment"
---

# DePix received without a matching checkout

`POST checkout.unmatched_payment` (webhook)

Sent when a DePix payment lands on the merchant's direct-rail address and cannot be tied to a checkout (wrong amount typed, payment after the grace window, several candidate checkouts, or a second payment for an already settled one). The funds are in the merchant's wallet; nothing is credited automatically, and the receipt is listed for manual reconciliation in the merchant app. Delivered to the merchant's default callback URL. Outbound POST to the merchant's callback URL, signed with `X-DePix-Signature: t=<unix ts>,v1=<hex hmac-sha256>` where the HMAC is computed over `"${t}.${raw body}"` with the merchant webhook secret. Verify the signature and reject stale timestamps. Delivery is retried on failure: immediate → 1m → 10m → 1h → 4h → 12h (max 6 attempts); use `data.event_id` to deduplicate. Respond with any 2xx quickly to acknowledge.

## Headers

- `X-DePix-Signature` string, required
- `X-DePix-Event-Id` string, required

## Payload

- object: Envelope of the checkout.unmatched_payment event.
  - `event` 'checkout.unmatched_payment', required: Event name — fixed for this webhook.
  - `data` UnmatchedPaymentWebhookData, required: A DePix payment landed on the merchant's direct-rail address but could not be tied to a checkout — the amount matched no open checkout, or it matched one that was already paid. The money IS in the merchant's wallet; only the automatic attribution failed, and reconciling it is a human decision (never an automatic credit).
    - `id` string, required: Detected-output id (dout_*) — stable handle for this receipt.
    - `type` 'depix_output', required: Resource discriminator — always "depix_output".
    - `status` 'unattributed' | 'duplicate', required: Why it was not credited: `unattributed` — no open checkout has this exact amount (wrong value typed, payment after expiry, or several candidates); `duplicate` — a second payment for a checkout that was already settled.
    - `amount_cents` integer, required: Amount received, in cents.
    - `txid` string, required: Liquid transaction id that carried the payment.
    - `vout` integer, required: Index of the paying output inside that transaction.
    - `first_seen_at` string, required: When the payment was first seen on the merchant's address (RFC 3339 UTC, `YYYY-MM-DDTHH:MM:SS.sssZ`). Same value — and same field name — the merchant dashboard lists it under; it is when the payment was SEEN, which may be minutes before this notification.
    - `reason` 'no_matching_checkout' | 'duplicate_payment' | 'ambiguous_candidates' | 'value_not_whole_cents' | 'max_attributions_per_tx' | 'transition_lost': Why the automatic attribution did not happen. `no_matching_checkout` — no open checkout carries this exact amount; `duplicate_payment` — the matching checkout was already settled; `ambiguous_candidates` — more than one open checkout matched, so none was credited; `value_not_whole_cents` — the amount is not a whole number of cents; `max_attributions_per_tx` — this transaction already paid the per-tx limit of checkouts; `transition_lost` — a concurrent settlement won the race. Advisory: reconcile on `id`, not on this string.
    - `event_id` string, required: Stable delivery id (evt_*) — identical across retries of the same event; use it for deduplication. Also sent as the X-DePix-Event-Id header.

## Acknowledgement `200`

Any 2xx acknowledges the delivery; anything else (or a timeout) schedules a retry.

---

[API](https://skmtc.dev/depixapp/apis/depix-api.md) · [All operations](https://skmtc.dev/depixapp/apis/depix-api/llms.txt) · [OpenAPI document](https://skmtc.dev/depixapp/apis/depix-api/revisions/04094536dd0f?raw)