On This Page
FILTER BY TAG

Enhanced Webhook URL Review and Approval Process

We have introduced an enhancement to webhook subscription processing to improve security, compliance, and visibility for webhook-related URLs. Webhook URLs are now validated and reviewed before they can be used. This includes both subscriptions and existing subscriptions currently on file.

Introduced Changes

When a webhook subscription is created or updated, the URLs associated with that subscription are evaluated through a validation and approval process.
Applies to:
  • Webhook URL (required)
  • OAuth URL (if applicable)
  • Health Check URL (if applicable)
As part of this enhancement, user-facing statuses have been added:
  • PENDING_REVIEW
  • BLOCKED
The existing INACTIVE status remains unchanged and continues to indicate that the subscription is approved and ready within the current lifecycle.

Status Descriptions

Status
Description
PENDING_REVIEW
One or more submitted URLs are being validated or awaiting required security approval.
BLOCKED
One or more URLs were rejected or identified as unsafe or non-compliant. The subscription cannot proceed until the URLs are updated.
INACTIVE
All required approvals are complete, and the subscription is ready under the existing activation flow.

How the New Process Works

  1. A webhook subscription is created or updated.
  2. Submitted URLs are checked against existing approval records.
  3. New or unknown URLs are evaluated through automated validation.
  4. If additional review is required, the subscription status changes to PENDING_REVIEW.
  5. If any URL is rejected or blocked, the subscription status changes to BLOCKED.
  6. If all required URLs are approved, the subscription status changes to INACTIVE.
In cases where a subscription status is changed to BLOCKED, merchants are expected to perform these tasks:
  1. Review the affected endpoints.
  2. Update the URLs to an acceptable endpoint.
  3. Resubmit the subscription for processing.

For New Subscriptions

New webhook-related URLs might go through validation and, if necessary, security review before the subscription can proceed.

Why We Are Making This Change

This enhancement provides these benefits:
  • Reduce security risk
     by preventing outbound calls to unapproved endpoints.
  • Improve compliance
     through stronger review and approval controls.
  • Increase transparency
     with clearer merchant-visible statuses.
  • Support scale
     through a standardized and repeatable validation process.
RELATED TO THIS PAGE