Zift Webhooks

Zift (a payments platform / gateway) delivers notifications — billing and processing events — to an HTTPS endpoint you register with Zift support. Each delivery is a plain HTTPS POST with a JSON body. There is no signature, no HMAC, and no auth header on the delivery. Instead, your endpoint proves it received the notification by echoing the notificationId back in the response body — that response is the acknowledgement, and skipping it triggers retries.

When to Use This Skill

• How do I receive Zift webhook notifications?
• How do I acknowledge a Zift webhook (the {"notificationId": ...} response)?
• Why is there no X-Zift-Signature / HMAC header to verify?
• How do I secure a Zift webhook endpoint with no signature?
• How do I handle Zift billing.* and processing.* events (chargeback, return, NOC)?
• Why does Zift keep retrying / marking my webhook Failed?

Verification & Acknowledgement (core)