# Payload

Every webhook has the same shape: the event name, when it was sent, and the full resource.

```http title="http · request headers"
POST /webhooks/weav HTTP/1.1
Host: shop.example
Content-Type: application/json
X-Signature: 9b2f4c…c41e
```

```json title="json · body"
{
    "event": "PAYMENT_COMPLETED",
    "sent_at": "2026-10-26T10:15:42+08:00",
    "data": {
        "payment": {
            "reference_id": "PY7K3Q9M2X4TBA",
            "external_reference_id": "ORD-10541",
            "channel": "QR_PH",
            "currency": "PHP",
            "amount": 1250.0,
            "fee": 31.25,
            "total": 1281.25,
            "amount_refunded": 0.0,
            "refunds": [],
            "status": "COMPLETED",
            "completed_at": "2026-10-26T10:15:40+08:00",
            "created_at": "2026-10-26T10:12:00+08:00"
        }
    }
}
```

| Field | Type | Description |
| --- | --- | --- |
| `event` | `string` | One of the [event types](https://docs.weavpayments.com/webhooks/event-types). |
| `sent_at` | `string` | When Weav sent this delivery. It is inside the body so the signature covers it. |
| `data` | `object` | The full resource under its own key. The payment above is shortened. |

A webhook never contains your signing key, an API key, or any other credential.