> For the complete documentation index, see [llms.txt](https://docs.omni.integratedcommerce.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.omni.integratedcommerce.io/webhooks/legacy.md).

# Legacy webhooks

The delivery method every merchant has today. Fiska support configures your endpoints, and every delivery is signed with the x-fsk-wh-chksm checksum.

Legacy webhooks are the delivery method every merchant has today. You do not opt in: when your account is set up, Fiska support registers the endpoint URLs you give them, subscribes each one to the event types you want, and gives you the shared secret that signs every delivery.

Legacy webhooks remain supported, with no announced retirement date. [Svix webhooks](/webhooks/svix.md) are available by invitation. If Fiska enables Svix for your account, follow [Moving from legacy to Svix](/webhooks/svix/moving-from-legacy.md) to configure and verify the new deliveries.

## What you get

|                           |                                                                                                                                                                                                         |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Set-up**                | Through [support](mailto:support@integratedcommerce.io): endpoint URLs, event types, and the shared secret. See [Configuring endpoints](/webhooks/legacy/configuration.md).                             |
| **Events**                | [Transaction events](/webhooks/events.md#transaction-events) and [token events](/webhooks/events.md#token-events). Merchant lifecycle events are delivered on Svix webhooks only.                       |
| **Signature**             | One header, `x-fsk-wh-chksm`: an HMAC-SHA256 of the raw request body, keyed with the shared secret, encoded as lowercase hex. See [Verifying the checksum](/webhooks/legacy/verifying-the-checksum.md). |
| **Retries**               | Failed deliveries are retried, but not on a published schedule.                                                                                                                                         |
| **Inspecting deliveries** | No portal. Ask support to investigate a delivery, or reconcile against [`GET /transactions`](/payments/transaction-retrieval.md).                                                                       |

## What a delivery looks like

```http
POST /webhooks HTTP/1.1
Content-Type: application/json
x-fsk-wh-chksm: 862c6f2473c97472be4262b04670e777b2ed145d12d8a1c79ffc52ea9cfe7f0f
```

The body is the JSON event payload described in the [event catalog](/webhooks/events.md). The checksum above is the one from the [worked example](/webhooks/legacy/verifying-the-checksum.md#worked-example).

## Know the limits

{% hint style="warning" %}
The legacy checksum covers only the body and carries no timestamp, so a captured delivery stays valid indefinitely and can be replayed. [Deduplicating on `event.id`](/webhooks/webhooks.md#deduplicate-on-event-id) - which you need anyway, because deliveries are retried - is what closes this gap: a replayed event carries an `event.id` you have already processed.
{% endhint %}

There is no self-service way to add an endpoint, rotate the secret, or replay a failed delivery. Each of those is a request to support. If you need any of them regularly, ask support whether your account can be invited to [Svix webhooks](/webhooks/svix.md).

## Next steps

* [Configuring endpoints](/webhooks/legacy/configuration.md)
* [Verifying the checksum](/webhooks/legacy/verifying-the-checksum.md)
* [Event catalog](/webhooks/events.md)
* [Moving from legacy to Svix](/webhooks/svix/moving-from-legacy.md), once Fiska has enabled Svix for your account