Verified BursaPay workflow: Prevent duplicate webhook deliveries from causing duplicate business operations.
1. Overview & Purpose
Webhook receivers must safely handle repeated events because delivery systems can retry events and the API itself treats previously processed events idempotently.
2. Requirements & Setup
Persist an event or transaction reference before applying a non-repeatable side effect.
3. Step-by-Step Workflow
- Extract the event and business reference.
- Check whether the event was already processed.
- Apply the business change inside an atomic transaction where appropriate.
- Record the processed state before acknowledging the event.
4. Rules & Troubleshooting
Do not rely only on HTTP request order. A duplicate event must return a safe success response without double-crediting, double-refunding or double-withdrawing.
5. Verification & Next Steps
Add automated duplicate-event tests for every critical webhook handler.