> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orsunpay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Transaction status event

> OrsunPay sends this POST to the transaction callbackUrl after a status update. Verify HMAC-SHA256 over the exact raw body before parsing, using the merchant webhook secret (ADR-010). Reject signature timestamps beyond 300 seconds; compare in constant time. Deliveries are at least once and can arrive out of order. Deduplicate by the signed body id. Secret rotation takes effect immediately (no dual signing); failed deliveries retry for approximately 31 hours. API keys are not sent with webhooks.



## OpenAPI

````yaml /openapi.json webhook transactionUpdated
openapi: 3.1.0
info:
  contact:
    name: OrsunPay
  description: >-
    Server-to-server merchant payments. Money is always a decimal string in
    major units.
  title: OrsunPay Merchant API
  version: '1.0'
servers: []
security: []
tags:
  - description: Poll stored merchant transaction status
    name: Transactions
  - description: Create merchant sales and payouts
    name: Payments
  - description: Request refunds and read stored refund outcomes
    name: Refunds
  - description: Signed merchant event deliveries
    name: Webhooks
  - description: Create, list and deactivate shareable merchant payment links
    name: Payment links
paths: {}

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.