Receive a signed Stripe event
Provider callback, not an end-user API. The exact raw JSON body is capped at 512 KiB and verified against Stripe-Signature before durable inbox claim or side effects. Provider event.id supplies idempotency; terminal duplicates return 200, active leases return 503 for retry, and failures return 500 so Stripe retries. No webhook secret, signature, raw payload or internal exception is returned. This route is excluded from every public MCP surface.
Headers
Stripe-generated signature verified over the exact raw body. It is sensitive request metadata and must never be logged or echoed.
Request body
Response
Event accepted, deliberately ignored, or already terminal. All response bodies are non-secret acknowledgements.
Changes
Changed in 1 of the 3 revisions of this API.1
- ○
endpoint added
endpoint-added
This revision also has 1 change that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog
- ○