Posted to the merchant's webhook URL (the webHookUrl of the payment request, otherwise the URL registered on the merchant profile) for payments created through POST /e-commerce/request, as the payment progresses (awaiting deposit, deposit received, confirmed on chain) and when it reaches a final status, before the shopper is redirected back to the merchant. The same orderStatus can arrive more than once (Pending in particular), so treat each body as the latest snapshot and make your handler idempotent; Success is sent once. If the payment request supplied a securityToken, it is sent verbatim in the Authorization header; otherwise a Salesforce integration receives the Salesforce access token there, and a {salesforce} placeholder in the URL is replaced with the Salesforce instance URL.
Acknowledgement that the update was received; the webhook is marked delivered.
Any other response or a connection failure. For a final order status (Success, Failed, Cancelled) the webhook is re-sent 2, 5, 20 and 50 minutes after it was created, unless a newer update for the same payment replaces it, then abandoned and RelayPay support is alerted. A failed Pending update is not retried.