Deposit transitioned to error
Sent when a deposit created via API key transitions to error (one event per real status transition, 1:1 with the raw status). Fires ONLY for operations attributed to an API key (human/SPA operations never dispatch) and only when the merchant has a default callback URL configured. Sandbox (sk_test_) operations create no rows, so they never fire webhooks. Outbound POST to the merchant's callback URL, signed with X-DePix-Signature: t=<unix ts>,v1=<hex hmac-sha256> where the HMAC is computed over "${t}.${raw body}" with the merchant webhook secret. Verify the signature and reject stale timestamps. Delivery is retried on failure: immediate → 1m → 10m → 1h → 4h → 12h (max 6 attempts); use data.event_id to deduplicate. Respond with any 2xx quickly to acknowledge.
Headers
t=<unix ts>,v1=<hex hmac-sha256> — HMAC-SHA256 over "${t}.${raw request body}" keyed with the merchant webhook secret.
The delivery's stable event id (evt_*) — same value as data.event_id.
Payload
Response
Any 2xx acknowledges the delivery; anything else (or a timeout) schedules a retry.
Changes
Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.