---
title: "Razorpay webhook receiver — HMAC-SHA256 verified, persists raw events"
method: POST
path: "/webhooks/razorpay"
tags: ["webhooks"]
---

# Razorpay webhook receiver — HMAC-SHA256 verified, persists raw events

`POST /webhooks/razorpay`

## Request

- Base URL: `https://api.travelminds.ai`
- URL: `https://api.travelminds.ai/webhooks/razorpay`
- Auth: none declared

Verifies the X-Razorpay-Signature header (HMAC-SHA256 of body with RAZORPAY_WEBHOOK_SECRET), then persists the raw event into tmai_payment_events. The reconciler worker maps events to tmai_subscriptions state.

## Headers

- `X-Razorpay-Signature` string, nullable

## Response `200`

Successful Response

- WebhookResponse
  - `received` boolean
  - `event_type` string, required
  - `event_id` string, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/travelminds/apis/travelmindsai-api-gateway.md) · [All operations](https://skmtc.dev/travelminds/apis/travelmindsai-api-gateway/llms.txt) · [OpenAPI document](https://skmtc.dev/travelminds/apis/travelmindsai-api-gateway/revisions/d05c8634e340?raw)