reseller

POST `/v1/reseller/webhooks/{code}/{orgId}`

Ingest a signed callback from a reseller's OWN payment gateway.

Authentication

This endpoint is public. It takes no credential and no organisation — it is what our own marketing site and AI answer engines read.

Where your organisation id goes

This endpoint takes your organisation id in the URL itself, as orgId. Substitute it into the path — there is no header or query parameter that will do instead.

Your organisation id is on the API keys screen in your dashboard, beside the key itself. It is the same id in every call you make.

Try it

Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.

curl -X POST https://api.zinndigital.com/v1/reseller/webhooks/{code}/{orgId}

Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console

Details

**Unauthenticated by design**, exactly like the platform callbacks above — the provider's signature over the raw body *is* the authentication. What differs is whose secret it is verified against: this endpoint resolves the reseller's own credential from Vault first, because `/v1/webhooks/{code}` verifies against **Zinn®'s** secret and answers `400 INVALID_SIGNATURE` to anything a reseller's account sends it. Without this endpoint a BYO gateway can charge but never settle asynchronously — no SCA completion, no mandate confirmation, no crypto IPN. ⛔ A valid signature is **not** an authorization to touch a tenant. It proves only that the delivery came from the account we hold keys for; the event may act only on organizations that bill back to this reseller, and anything else is acknowledged with 200 and changes nothing. Replays are expected and converge on a dedupe key namespaced per reseller, so two accounts delivering the same provider event id cannot silently cancel each other out.

Parameters

Name	Type	Required	What it is
`code (path)`	`string`	Yes	The gateway code — `stripe`, `paypal` or `nowpayments`.
`orgId (path)`	`Uuid`	Yes	The RESELLER organization whose own gateway account is calling back. It is in the path because the signing secret is per organization: the engine must resolve their credential…

Response

Name	Type	Required	What it is
`status`	`string<handled, ignored, duplicate>`	Yes	`handled` — acted on. `ignored` — a valid event of a type Zinn® does not consume. `duplicate` — already processed; Stripe may stop redelivering.

Errors this endpoint can return

400 · 404 · 503