Order webhook events - SixPay Docs

This page covers one-time order events. Subscription events use a different payload and are documented in Subscription webhook events. Every event contains id, type, occurredAt, merchant, and an order object.

Event types

Event	Meaning
`order.locked`	Payment has entered the locked state.
`order.paid`	Payment has been paid.
`order.delivered`	Settlement has been delivered normally.
`order.force_delivered`	Settlement was delivered through the force-delivery path.
`order.refunded`	Payment was refunded.
`order.expired`	Order expired before completion.

Order fields to persist

Field	Use
`id`	Deduplicate webhook delivery.
`order.intentId`	Primary SixPay payment identifier.
`order.merchantOrderId`	Merchant-side order correlation; can be `null` in direct flows.
`order.status`	Canonical SixPay order status.
`occurredAt`	Event ordering and audit timestamp.
transaction hashes	Reconciliation and support investigation.

Signature headers

Verify every delivery using the raw body and the x-sixpay-signature, x-sixpay-keyid, x-sixpay-timestamp, and x-sixpay-nonce headers. Obtain public signing keys from GET /v1/signing-keys and enforce nonce replay protection before applying state changes. See webhook integration for the required handling sequence.