Square payment.updated webhook payload example

Square · event: payment.updated · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

See it live, not frozen

One click creates a free capture bin with this exact payload already in it — pretty-printed, headers inspectable, replayable to your own endpoint:

Then paste the bin's URL into Square's webhook settings to capture a real delivery. No signup.

Headers

content-type: application/json
user-agent: Square Connect v2
x-square-hmacsha256-signature: gPzOT2NsFJEXAMPLEbase64hmacEXAMPLEUuFsGd0cs=

Body

{
  "merchant_id": "6SSW7HV8K2ST5",
  "type": "payment.updated",
  "event_id": "13b867cf-db3d-4b1c-90b6-2f32a9d78124",
  "created_at": "2026-08-29T00:00:00.087Z",
  "data": {
    "type": "payment",
    "id": "KkAkhdMsgzn59SM8A89WgKwekxLZY",
    "object": {
      "payment": {
        "id": "KkAkhdMsgzn59SM8A89WgKwekxLZY",
        "status": "COMPLETED",
        "amount_money": {
          "amount": 2995,
          "currency": "USD"
        },
        "order_id": "nUSN9TdxpiK3SrQg3wzmf6r8LP9YY",
        "created_at": "2026-08-28T23:59:58.907Z",
        "updated_at": "2026-08-29T00:00:00.087Z",
        "version": 2
      }
    }
  }
}

Things that bite people

Square signs {notification_url}{rawBody} — the URL is part of the signed string, so the #1 verification failure is a URL mismatch (http vs https, trailing slash, proxy rewrite). Generic HMAC testers structurally can't verify it; a Hookden bin can, because it knows its own URL: Square signature verification failed.
Only a 2xx counts as delivered; retries back off exponentially for 24h and add square-retry-number / square-retry-reason headers.
amount_money.amount is in the currency's smallest unit (2995 = $29.95).

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'user-agent: Square Connect v2' \
  -H 'x-square-hmacsha256-signature: gPzOT2NsFJEXAMPLEbase64hmacEXAMPLEUuFsGd0cs=' \
 -d '{"merchant_id":"6SSW7HV8K2ST5","type":"payment.updated","event_id":"13b867cf-db3d-4b1c-90b6-2f32a9d78124","created_at":"2026-08-29T00:00:00.087Z","data":{"type":"payment","id":"KkAkhdMsgzn59SM8A89WgKwekxLZY","object":{"payment":{"id":"KkAkhdMsgzn59SM8A89WgKwekxLZY","status":"COMPLETED","amount_money":{"amount":2995,"currency":"USD"},"order_id":"nUSN9TdxpiK3SrQg3wzmf6r8LP9YY","created_at":"2026-08-28T23:59:58.907Z","updated_at":"2026-08-29T00:00:00.087Z","version":2}}}}'

← All payload examples · Related guide · Signature debugger · Docs