> ## Documentation Index
> Fetch the complete documentation index at: https://internal.mechzie.in/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Razorpay webhook (no auth)

> Receives Razorpay event notifications. Requires the `X-Razorpay-Signature`
header for HMAC-SHA256 body verification. Returns `200` even on business-logic
errors to prevent Razorpay from retrying. Returns `400` when the request body
is missing or cannot be parsed.




## OpenAPI

````yaml /openapi.yaml post /payments/webhook
openapi: 3.1.0
info:
  title: MechZie API
  version: 1.0.0-rc1
  description: On-demand roadside mechanic dispatch service API (MechZie)
  contact:
    name: MechZie Support
    email: support@mechzie.com
  license:
    name: MIT
    identifier: MIT
servers:
  - url: http://localhost:3000
    description: Local development
  - url: https://mechzie-api-399967621389.asia-south1.run.app/api/v1
    description: Production
security:
  - bearerAuth: []
tags:
  - name: auth
    description: Authentication and token management
  - name: users
    description: User profile operations
  - name: vehicles
    description: Customer vehicle management
  - name: mechanics
    description: Mechanic profile and availability
  - name: jobs
    description: Job lifecycle and line items
  - name: tracking
    description: Real-time location tracking
  - name: payments
    description: Razorpay payment integration
  - name: wallet
    description: Mechanic wallet, UPI accounts, disputes, refunds, and settlements
  - name: ratings
    description: Customer and mechanic ratings
  - name: service-categories
    description: Service category management
  - name: notifications
    description: Push notifications and FCM tokens
  - name: uploads
    description: S3 presigned URL generation
  - name: admin
    description: Admin dashboard and management
  - name: super-admin
    description: Super-admin only operations (invite management, role assignment)
  - name: comms
    description: In-job audio calls (100ms) and persistent chat (Socket.IO + REST)
  - name: call
    description: >-
      Call signaling layer — initiate, accept, decline, cancel, end (ringing via
      FCM + Redis over 100ms rooms)
  - name: health
    description: Health check endpoints
paths:
  /payments/webhook:
    post:
      tags:
        - payments
      summary: Razorpay webhook (no auth)
      description: >
        Receives Razorpay event notifications. Requires the
        `X-Razorpay-Signature`

        header for HMAC-SHA256 body verification. Returns `200` even on
        business-logic

        errors to prevent Razorpay from retrying. Returns `400` when the request
        body

        is missing or cannot be parsed.
      parameters:
        - name: X-Razorpay-Signature
          in: header
          required: true
          schema:
            type: string
          description: HMAC-SHA256 signature computed by Razorpay over the raw request body
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                event:
                  type: string
                  example: payment.captured
                payload:
                  type: object
      responses:
        '200':
          description: Webhook received and processed (or ignored gracefully)
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: string
                    example: ok
        '400':
          description: Missing or unparseable request body
      security: []
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: JWT access token from /auth/verify-otp

````