---
title: "Stripe webhook endpoint (signature-verified; not for direct use)"
method: POST
path: "/api/rightos/billing/webhook"
tags: ["billing"]
---

# Stripe webhook endpoint (signature-verified; not for direct use)

`POST /api/rightos/billing/webhook`

## Request

- Base URL: `https://rightos.i-s3.com`
- URL: `https://rightos.i-s3.com/api/rightos/billing/webhook`
- Auth: none required

Verifies the stripe-signature header against the webhook secret. Handles checkout.session.completed, customer.subscription.updated, and customer.subscription.deleted (downgrade to free; data is never deleted).

## Response `200`

Event received

## Other responses

- `400`: missing_signature / invalid_signature
- `503`: billing_not_configured

---

[API](https://skmtc.dev/i-s3/apis/rightos-right-api.md) · [All operations](https://skmtc.dev/i-s3/apis/rightos-right-api/llms.txt) · [OpenAPI document](https://skmtc.dev/i-s3/apis/rightos-right-api/revisions/10020536e345?raw)