payment
Lava Webhook
lava.top webhook — credential verified in the decorator.
Credits balance_usd for RUB-session recharges (payment.success). lava's webhook carries no signature (static header credential only), so before crediting we RE-FETCH the invoice from lava's own API and require status=COMPLETED — a forged webhook cannot make lava's API say that. The rest is the standard acquirer contract: row-lock + status idempotency, DB-amount-of-truth (we credit order.amount USD, never a webhook figure), amount/currency reconciliation against orders.amount_rub.
URL has NO trailing slash on purpose: LanguageMiddleware 301s any trailing-slash path, which would break lava's POST delivery.
post/api/v1/payment/lava/callback
Response
Successful Response
{"stackTrail":"paths:/api/v1/payment/lava/callback:post:responses:200:content:application/json:schema","oasType":"schema","type":"unknown"}