Delivery headers
Saleringo-Event-Id: evt_...
Saleringo-Delivery-Timestamp: 2026-08-18T00:00:00Z
Saleringo-Delivery-Signature: v1=...Webhook delivery
Verify and process Saleringo webhooks
Verify the raw delivery, reject stale events, acknowledge quickly, and process each event once.
CONTRACT WORKBENCHSERVER → SALERINGO
EVENT
customer.updated- Body
- raw bytes
- Signature
- verified
- Response
- quick
- Processing
- once
Accept an event quickly, prove it is authentic, and process it once.
IMPLEMENTATION OUTCOME
Accept an event quickly, prove it is authentic, and process it once.
Event catalogue, signing secret, retry schedule, retention, and support escalation are confirmed for the approved integration.
- 1 · Read raw bytesDo not parse or transform the body before signature verification.
- 2 · Check time and signatureReject stale timestamps and signatures that do not match the supplied secret.
- 3 · Acknowledge quicklyReturn the documented success response before starting long-running work.
- 4 · DeduplicateUse the event ID as the durable once-only processing boundary.
REQUEST → RESULT
Keep the request, result, and evidence together.
Receiver behavior
verify(rawBody, timestamp, signature)
storeOnce(eventId)
enqueue(parsedEvent)
return acceptedResponse()RECOVERY CONTRACT
A retry is not the answer to every failure.
StatusMeaningClient action
401Credential is missing, expired, or invalidStop; refresh through the approved server flow.
403Identity lacks the exact permission or scopeDo not retry; request an access review.
409State, version, idempotency, or approval conflictsRead the conflict and reconcile before another command.
422The request does not match the published schemaCorrect the named fields; do not retry unchanged.
429The integration is sending too quicklyHonor the supplied wait guidance and apply backoff.
5xxA temporary service failure may have occurredPreserve IDs; retry only when the operation permits it.
IMPLEMENTATION SUPPORT
Bring one operation. Leave with the next test your team can run.
Do not send credentials, customer secrets, or raw payment data. Include the contract version, environment, operation, timestamp, and non-sensitive correlation ID.