Webhooks and event delivery

How delivery works

When something happens on a partner resource you own — a decision is reached, a payment settles, an e-sign envelope completes — Credicorp POSTs a JSON event to the URL you registered. Each delivery carries a signature header derived from a shared secret so you can prove the payload came from Credicorp and was not tampered with. Your endpoint should verify the signature, do minimal synchronous work, and return a 2xx quickly; queue the heavy processing.

Retries and ordering

Delivery is at-least-once. If your endpoint is slow, errors, or returns a non-2xx, Credicorp retries on a backing-off schedule for a bounded window. That means you may receive the same event more than once and occasionally out of order — so process events idempotently, keyed on the event ID, and treat the event's own timestamp/state as the source of truth rather than arrival order.

Verifying before trusting

Never act on an unverified webhook. Recompute the signature over the raw request body with your endpoint's secret and compare in constant time; reject on mismatch with a 400. See verifying a webhook signature for a worked example, and building an idempotent consumer for the processing side.