Estorno concluído
Estorno concluído; data.object = pagamento, data.refund = estorno. O ajuste de captura parcial (CAPTURE_ADJUSTMENT) não gera o evento.
Escopo de leitura exigido do cliente dono do endpoint: um de payments:pix:read, payments:boleto:read, payments:cards:read.
Entrega: POST na url do endpoint com Content-Type: application/json; charset=utf-8, corpo de até 256 KB, TLS 1.2+, sem seguir redirect, IP validado contra SSRF a cada tentativa. Verificar a assinatura sobre os bytes crus (nunca sobre JSON re-serializado). Entrega duplicada é esperada e a ordem não é garantida: deduplicar por id.
X-Kodano-Signature*stringt=<unix em segundos>,v1=<hex>; durante a rotação, t=<unix>,v1=<novo>,v1=<anterior>. v1 = hex minúsculo de HMAC-SHA256(chave = bytes UTF-8 do segredo inteiro, inclusive whsec_; mensagem = "{t}." + bytes crus do corpo). Rejeitar |agora − t| > 300 s, comparar em tempo constante e aceitar se qualquer v1 conferir.
X-Kodano-Event-Id*stringIgual ao id do corpo; chave de deduplicação.
^evt_X-Kodano-Event-Type*stringIgual ao type do corpo.
"payment.succeeded""payment.failed""payment.refunded""chargeback.received""withdrawal.completed""withdrawal.failed""fx.operation.settled""fx.operation.expired""fx.operation.failed""fx.operation.action_required""fx.operation.refunded""settlement.closed""webhook_endpoint.disabled""ping"User-Agent*stringKodano-Webhooks/1.0.
application/json- body
Envelope: corpo assinado do webhook, item de GET /v1/events e resposta de GET /v1/events/{id}.
id*stringIgual ao header X-Kodano-Event-Id; chave de deduplicação.
^evt_type*string"payment.succeeded""payment.failed""payment.refunded""chargeback.received""withdrawal.completed""withdrawal.failed""fx.operation.settled""fx.operation.expired""fx.operation.failed""fx.operation.action_required""fx.operation.refunded""settlement.closed""webhook_endpoint.disabled""ping"apiVersion*string2026-10-01.
createdAt*stringdate-timeenvironment*string"sandbox""production"merchantId*|mrc_…; null em evento de organização.
data*Recebido. Sucesso é qualquer 2xx em até 10 s (DNS, TLS e resposta inclusos); o corpo da resposta é ignorado.
{ "id": "evt_eLAeXfIkpXkuN51gMG1J3aYxprFLfIAo", "type": "payment.refunded", "apiVersion": "2026-10-01", "createdAt": "2026-10-16T18:30:02Z", "environment": "sandbox", "merchantId": "mrc_e3cc4727054da558273162251e310d29", "data": { "object": { "id": "pay_Nj7ZJCZ9jM7SGGmnjGl9UAXLW7BpYwCL", "status": "PARTIALLY_REFUNDED", "method": "PIX", "amount": 15990, "currency": "BRL", "description": "Pedido 123", "customer": { "id": "cus_Lbfbv3xA5PQh8H5jKlF7yXqRNJxlSZXf", "name": "Ana Souza", "document": "123******09" }, "pix": { "qrCode": "00020101021226840014br.gov.bcb.pix2562pix.exemplo.com.br/qr/v2/cobv/5c1b2a3d4e5f60718293a4b5c6d7e8f95204000053039865802BR5911ACME LTDA6009SAO PAULO62070503***6304A1B2", "copyPaste": "00020101021226840014br.gov.bcb.pix2562pix.exemplo.com.br/qr/v2/cobv/5c1b2a3d4e5f60718293a4b5c6d7e8f95204000053039865802BR5911ACME LTDA6009SAO PAULO62070503***6304A1B2", "expiresAt": "2026-10-16T14:00:00Z", "endToEndId": "E18236120202610161302s0a1b2c3d4e" }, "failure": null, "statusReason": null, "refundedAmount": 5000, "refundedAt": "2026-10-16T18:30:00Z", "paymentLinkId": null, "metadata": { "orderRef": "123" }, "createdAt": "2026-10-16T13:00:00Z", "updatedAt": "2026-10-16T18:30:00Z" }, "refund": { "id": "ref_EN9MqxQZIpd3nf12U7pIXifnAXOs7j69", "amount": 5000, "currency": "BRL", "status": "SUCCEEDED", "reason": null, "failure": null, "createdAt": "2026-10-16T18:29:48Z", "updatedAt": "2026-10-16T18:30:00Z" } }}{ "X-Kodano-Signature": "t=1792155732,v1=d3e134866c73f1ace702a6dab8e1d8225c471951a3f88f395c987bc441b22962", "X-Kodano-Event-Id": "string", "X-Kodano-Event-Type": "payment.succeeded", "User-Agent": "Kodano-Webhooks/1.0"}