Webhook endpoints
POST /api/billing/webhookreceives Dodo events. It verifieswebhook-id,webhook-signature, andwebhook-timestampagainst the raw body before applying credits.POST /telemetry/agent-eventrecords public agent attribution events. It does not store raw prompts, payment credentials, or private customer payloads.
Agent rules
- External agents must not call the Dodo webhook directly.
- Checkout redirects are not proof of entitlement.
- Completed actions should return a verification artifact with source, timestamp, status, evidence, signature metadata, and failure class.