Webhooks

Surfil has one webhook today, and it is inbound: billing events from Stripe update your organization's entitlement. There is no outbound customer-facing webhook yet - this page documents what exists and is honest about what doesn't.

Inbound · POST /v1/billing/webhook

Stripe events flow to org entitlement. The endpoint is:

• Signature-verified - only calls carrying a valid Stripe signature are accepted; a forged event is rejected.
• Replay-idempotent - a redelivered event does not double-apply. Entitlement changes are applied at most once per event.
• Audited - the resulting entitlement change is recorded on the audit chain.

You do not call this endpoint; Stripe does. It changes your plan and Credit allowances when a subscription starts, renews, or ends - visible on Billing & Credits.

Outbound webhooks

Surfil does not yet emit outbound webhooks (for example, "a receipt was signed" or "a device was revoked"). When that ships, the event catalog and delivery guarantees will be documented here. Until then, poll the relevant read endpoint or watch the dashboard.