PayPal PAYMENT.CAPTURE.COMPLETED webhook payload example

PayPal · event: PAYMENT.CAPTURE.COMPLETED · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

See it live, not frozen

One click creates a free capture bin with this exact payload already in it — pretty-printed, headers inspectable, replayable to your own endpoint:

Then paste the bin's URL into PayPal's webhook settings to capture a real delivery. No signup.

Headers

content-type: application/json
user-agent: PayPal/AUHD-214.0-58538140
paypal-transmission-id: 69cd13f0-84c6-11ef-91a5-3f0a2c8d6e5b
paypal-transmission-time: 2026-08-29T07:30:00Z
paypal-transmission-sig: kNikbAECqTNvmDDVzHrCf9NMV4qUY8XGxSFTIVfIcWFrbt1sNb2Ln9EXAMPLEfake64hL9G0lyRvVQXg3RSCteAO5F5aVOEXAMPLE=
paypal-cert-url: https://api.paypal.com/v1/notifications/certs/CERT-360caa42-fca2a594-1d93a270
paypal-auth-algo: SHA256withRSA

Body

{
  "id": "WH-58D329510W468432D-8HN650336L201105X",
  "event_version": "1.0",
  "create_time": "2026-08-29T07:29:58.123Z",
  "resource_type": "capture",
  "resource_version": "2.0",
  "event_type": "PAYMENT.CAPTURE.COMPLETED",
  "summary": "Payment completed for $ 20.58 USD",
  "resource": {
    "id": "3VW75561ML0021234",
    "status": "COMPLETED",
    "amount": {
      "currency_code": "USD",
      "value": "20.58"
    },
    "final_capture": true,
    "seller_protection": {
      "status": "ELIGIBLE",
      "dispute_categories": [
        "ITEM_NOT_RECEIVED",
        "UNAUTHORIZED_TRANSACTION"
      ]
    },
    "supplementary_data": {
      "related_ids": {
        "order_id": "5O190127TN364715T"
      }
    },
    "create_time": "2026-08-29T07:29:55Z",
    "update_time": "2026-08-29T07:29:57Z"
  }
}

Things that bite people

The signature is RSA over a certificate (paypal-auth-algo: SHA256withRSA), not an HMAC — no offline tester can check it. Verify via PayPal's /v1/notifications/verify-webhook-signature API or an SDK; the signed string is transmissionId | timeStamp | webhookId | crc32(rawBody), so you also need your webhook's ID.
Simulator events sign with the literal string WEBHOOK_ID instead of your real webhook ID — code that passes on simulator traffic can fail in production (and vice versa). Details: PayPal webhook not working.
Delivery is HTTPS port 443 only, and sandbox/live apps are fully separate subscriptions — the wrong-app mismatch is the top "nothing arrives" cause.
Any non-200 outcome triggers up to 25 retries over 3 days; retries deliver the same event id — dedupe on it.
Money is nested at resource.amount.value as a decimal string.

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'user-agent: PayPal/AUHD-214.0-58538140' \
  -H 'paypal-transmission-id: 69cd13f0-84c6-11ef-91a5-3f0a2c8d6e5b' \
  -H 'paypal-transmission-time: 2026-08-29T07:30:00Z' \
  -H 'paypal-transmission-sig: kNikbAECqTNvmDDVzHrCf9NMV4qUY8XGxSFTIVfIcWFrbt1sNb2Ln9EXAMPLEfake64hL9G0lyRvVQXg3RSCteAO5F5aVOEXAMPLE=' \
  -H 'paypal-cert-url: https://api.paypal.com/v1/notifications/certs/CERT-360caa42-fca2a594-1d93a270' \
  -H 'paypal-auth-algo: SHA256withRSA' \
 -d '{"id":"WH-58D329510W468432D-8HN650336L201105X","event_version":"1.0","create_time":"2026-08-29T07:29:58.123Z","resource_type":"capture","resource_version":"2.0","event_type":"PAYMENT.CAPTURE.COMPLETED","summary":"Payment completed for $ 20.58 USD","resource":{"id":"3VW75561ML0021234","status":"COMPLETED","amount":{"currency_code":"USD","value":"20.58"},"final_capture":true,"seller_protection":{"status":"ELIGIBLE","dispute_categories":["ITEM_NOT_RECEIVED","UNAUTHORIZED_TRANSACTION"]},"supplementary_data":{"related_ids":{"order_id":"5O190127TN364715T"}},"create_time":"2026-08-29T07:29:55Z","update_time":"2026-08-29T07:29:57Z"}}'

← All payload examples · Related guide · Signature debugger · Docs