Payment Requires Action
Sent when the bank asks the buyer to verify an off-session charge, such as a subscription renewal or a saved-card payment your server made. data.recovery_url is the Whop link where the buyer signs in and completes 3D Secure; the event is only sent while that link exists, so it is null only when you lack member:basic:read. Then handle payment.succeeded or payment.failed for the outcome.
Required permissions:
payment:basic:readplan:basic:readaccess_pass:basic:readmember:email:readmember:basic:readmember:phone:readpromo_code:basic:readshipment:basic:readpayment:dispute:readpayment:resolution_center_case:readwebhook_receive:payments
Headers
A unique identifier for this webhook request
"msg_xxxxxxxxxxxxxxxxxxxxxxxx"
The signature of the webhook request with the webhook version prepended
"v1,BASE64ENCODEDSIGNATURE"
The timestamp in seconds since the Unix epoch that the webhook was sent at on the server
"1727606400"
Body
The API version for this webhook
"v1""v1"
The dated API version (Api-Version-Date) the payload is serialized to
"2026-07-20"
A unique ID for every single webhook request
"msg_xxxxxxxxxxxxxxxxxxxxxxxx"
The timestamp in ISO 8601 format that the webhook was sent at on the server
"2025-01-01T00:00:00.000Z"
The webhook event type
"payment.requires_action""payment.requires_action"
The account ID that this webhook event is associated with
"biz_xxxxxxxxxxxxxx"
For some .updated events, the old values of the payload fields that changed, keyed by field name. Omitted when no capture is available for the event
Response
Return a 200 status to indicate that the data was received successfully

