Webhooks
Receive signed collection events.
Register an HTTPS callback with PUT /v1/merchant/webhook and body {"url":"https://your.example/webhooks/etulip"}. Save the returned secret immediately; registering again rotates it.
We POST a JSON event with X-eTulip-Event and X-eTulip-Signature: sha256=<hex>. Verify the HMAC SHA-256 of the raw body bytes using your webhook secret before accepting the event. Use event_id for deduplication. Respond with a 2xx status promptly; failed deliveries are retried up to eight times.
A successful collection event contains the transaction ID, amount, fee, net, and before/after operator balance. Always confirm ownership and reconcile with GET /v1/transactions/{id}/status if needed.
The incoming Qosic callback remains disabled until its actual signature and payload contract have been confirmed. Status polling provides a separate refresh path.