POST /payments/refund. The refund is pending at this point; no money has moved yet.
Body
The body carries metadata about the event, not the entity itself. UseentityId to fetch the current state with GET /payments/refund/{refundId}, and dedupe on eventId
since deliveries are at-least-once and unordered.
Authentication
Every delivery is signed with aslash-webhook-signature header. Verify it
against Slash’s public key before trusting the payload; see
Webhook Signing for the
verification steps and a code sample. Respond with any 2xx within 10
seconds to acknowledge; anything else is retried.