Subscribe to a payment: paid webhook + free AML

The lifecycle

Create a payment with an order_id, amount, and network (cabinet or Public API). The customer sends funds to the deposit address. RpcNode emits HMAC-signed POSTs to your webhook URL.

• seen — deposit observed on-chain
• aml_check — funds arrived, free AML screen in progress
• paid — success webhook + AML result (score, risk_level, detail_list, risk_detail)
• failed / underpaid / expired — terminal non-success states

Do not confuse this with Address Watch

Payments product payloads always have product="payments" and type="payment_order". Address Watch wallet hits use type=payment|payout|block and a direction field. If you mix the two in one handler, branch on product or type first.

event=paid (AML included)

{
  "product": "payments",
  "type": "payment_order",
  "event": "paid",
  "order_id": "your-order-id",
  "network": "ethereum",
  "amount": "100.00",
  "aml": {
    "score": 0,
    "risk_level": "Low",
    "hacking_event": "",
    "detail_list": [],
    "risk_detail": [],
    "address_label": "",
    "checked_at": "2026-08-16T10:00:00+00:00"
  }
}

Verify HMAC, then update your order

Every delivery includes X-Timestamp and X-Signature. Verify before you mark an invoice paid. Allowlist egress IPs from GET /v1/address-watch/webhook (egress_ips). Delivery is async — a cabinet Test enqueues work; it does not wait for your HTTP response.

Payments slots are on paid plans (Starter and up). Free includes RPC credits only. Pricing: rpcnode.dev/pricing. API: docs.rpcnode.dev/public-api/webhooks.

FAQ