Take webhooks, and backfill what the stream missed
Webhooks keep the system of record current, and a backfill sweep keeps it complete.
Your answers so far
Choose one
What to build
Subscribe to the transaction events and write each one into your system of record as it arrives, then run a periodic query for the window you have already covered and insert anything missing. Check the delivery log when a gap shows up, because it says whether the delivery was never attempted or was attempted and refused, and those have different fixes on your side.
What this means for PCI
This is guidance rather than a compliance determination. Which questionnaire you are eligible for depends on your full environment, so confirm it with your QSA or your acquirer before you rely on it.
Worth knowing
- Delivery is at least once. Record the event id you have already handled and ignore a repeat, because a retry after a slow acknowledgement is an ordinary event rather than a fault.
- Acknowledge within five seconds. Put the raw body on a queue and process it after you have answered, because slow handling is retried and a retry is a duplicate you then have to discard.
- Store the event id alongside the payment. It's what lets you tell a redelivery from a second payment, and what the delivery log is searchable by when you are reconciling one.
- Verify the signature before you trust the body. A system of record is exactly the thing worth writing a forged event into.