Receive signed Stripe settlement events

POST /api/v1/billing/webhook

{
  "required": true,
  "content": {
    "application/json": {
      "schema": {}
    }
  }
}

{
  "x-response-schema-completeness": "unmodeled",
  "x-rate-limit": {
    "requests": 300,
    "windowMilliseconds": 60000,
    "key": "request IP",
    "headers": [
      "x-ratelimit-limit",
      "x-ratelimit-remaining",
      "x-ratelimit-reset"
    ]
  },
  "x-idempotency": {
    "policy": "not-generalized",
    "note": "There is no universal Idempotency-Key middleware. Only the documented endpoint mechanisms protect retries."
  }
}

{
  "operationId": "post_api_v1_billing_webhook",
  "summary": "Receive signed Stripe settlement events",
  "description": "Inbound Stripe integration endpoint. Requires the raw request body and stripe-signature header verified against STRIPE_WEBHOOK_SECRET. This is not an outbound customer webhook subscription API.\n\nPublic endpoint; tenant data is not exposed by discovery endpoints.\n\nThe request schema is generated from the runtime Zod input validator. Cross-field refinements and state-dependent constraints are additionally enforced by the API.",
  "tags": [
    "Billing"
  ],
  "security": [],
  "parameters": [
    {
      "name": "stripe-signature",
      "in": "header",
      "required": true,
      "description": "Stripe-generated signature over the exact raw request bytes.",
      "schema": {
        "type": "string"
      }
    }
  ],
  "requestBody": {
    "required": true,
    "content": {
      "application/json": {
        "schema": {}
      }
    }
  },
  "responses": {
    "400": {
      "description": "Invalid request or unsupported fields",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "401": {
      "description": "Missing or invalid authentication",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "403": {
      "description": "Permission or product scope refused",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "404": {
      "description": "Route or tenant-scoped resource not found",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "409": {
      "description": "State, revision, approval, funding or idempotency conflict",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "422": {
      "description": "Supplier configuration, capability or upstream refusal",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "429": {
      "description": "Rate limit reached; wait before retrying",
      "headers": {
        "x-ratelimit-limit": {
          "description": "Maximum requests permitted in the current rate-limit window.",
          "schema": {
            "type": "integer"
          }
        },
        "x-ratelimit-remaining": {
          "description": "Requests remaining in the current window.",
          "schema": {
            "type": "integer"
          }
        },
        "x-ratelimit-reset": {
          "description": "Seconds until the current rate-limit window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "retry-after": {
          "description": "Minimum seconds to wait before retrying.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "500": {
      "description": "Internal error; inspect state before retrying a mutation",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "503": {
      "description": "Dependency or authentication verifier unavailable",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "2XX": {
      "description": "Successful response. Response schema completeness: unmodeled. The request contract is complete; nested service payloads are not yet fully modeled in OpenAPI. Inspect returned fields before generating a typed SDK.",
      "headers": {
        "x-ratelimit-limit": {
          "description": "Maximum requests permitted in the current rate-limit window.",
          "schema": {
            "type": "integer"
          }
        },
        "x-ratelimit-remaining": {
          "description": "Requests remaining in the current window.",
          "schema": {
            "type": "integer"
          }
        },
        "x-ratelimit-reset": {
          "description": "Seconds until the current rate-limit window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {}
        }
      }
    }
  },
  "x-response-schema-completeness": "unmodeled",
  "x-rate-limit": {
    "requests": 300,
    "windowMilliseconds": 60000,
    "key": "request IP",
    "headers": [
      "x-ratelimit-limit",
      "x-ratelimit-remaining",
      "x-ratelimit-reset"
    ]
  },
  "x-idempotency": {
    "policy": "not-generalized",
    "note": "There is no universal Idempotency-Key middleware. Only the documented endpoint mechanisms protect retries."
  }
}