Enhanced Webhook URL Review and Approval Process {#webhooks-urls}
=================================================================

We have introduced an enhancement to webhook subscription processing to improve security, compliance, and visibility for webhook-related URLs. Webhook URLs are now validated and reviewed before they can be used. This includes both subscriptions and existing subscriptions currently on file.

**Introduced Changes** {#webhooks-urls_section_dnx_jdt_1jc}
-----------------------------------------------------------

When a webhook subscription is created or updated, the URLs associated with that subscription are evaluated through a validation and approval process.  
Applies to:

* Webhook URL (required)
* OAuth URL (if applicable)
* Health Check URL (if applicable)

{#webhooks-urls_ul_enx_jdt_1jc}  
As part of this enhancement, user-facing statuses have been added:

* PENDING_REVIEW
* BLOCKED

{#webhooks-urls_ul_fnx_jdt_1jc}  
The existing INACTIVE status remains unchanged and continues to indicate that the subscription is approved and ready within the current lifecycle.

Status Descriptions
-------------------

|   **Status**   |                                                           **Description**                                                            |
|----------------|--------------------------------------------------------------------------------------------------------------------------------------|
| PENDING_REVIEW | One or more submitted URLs are being validated or awaiting required security approval.                                               |
| BLOCKED        | One or more URLs were rejected or identified as unsafe or non-compliant. The subscription cannot proceed until the URLs are updated. |
| INACTIVE       | All required approvals are complete, and the subscription is ready under the existing activation flow.                               |

**How the New Process Works** {#webhooks-urls_section_hnx_jdt_1jc}
------------------------------------------------------------------

1. A webhook subscription is created or updated.

2. Submitted URLs are checked against existing approval records.

3. New or unknown URLs are evaluated through automated validation.

4. If additional review is required, the subscription status changes to PENDING_REVIEW.

5. If any URL is rejected or blocked, the subscription status changes to BLOCKED.

6. If all required URLs are approved, the subscription status changes to INACTIVE.
   {#webhooks-urls_ol_inx_jdt_1jc} In cases where a subscription status is changed to BLOCKED, merchants are expected to perform these tasks:

7. Review the affected endpoints.

8. Update the URLs to an acceptable endpoint.

9. Resubmit the subscription for processing.
   {#webhooks-urls_ul_lnx_jdt_1jc}

**For New Subscriptions** {#webhooks-urls_section_mnx_jdt_1jc}
--------------------------------------------------------------

New webhook-related URLs might go through validation and, if necessary, security review before the subscription can proceed.

**Why We Are Making This Change** {#webhooks-urls_section_pnx_jdt_1jc}
----------------------------------------------------------------------

This enhancement provides these benefits:

* **Reduce security risk** by preventing outbound calls to unapproved endpoints.
* **Improve compliance** through stronger review and approval controls.
* **Increase transparency** with clearer merchant-visible statuses.
* **Support scale** through a standardized and repeatable validation process.
  {#webhooks-urls_ul_qnx_jdt_1jc}