payment.settled, settlement.completed, or similar events, and there is no Sohopay-Signature header to verify. Fulfillment is driven by the facilitator status poll.
Use GET /api/v1/facilitator/settle/status/by-payment/:paymentId as documented in Settlements. Poll about every 2 seconds from the moment capture returns. Unlock on CONFIRMED only.
If you need a push notification into your own systems, poll from your worker and emit an event inside your application when the status transitions. That worker is yours. SohoPay will not retry a webhook, because it does not send one.
Next steps
Merchant integration
The capture call that creates the payment id.
Testing
Exercise capture and the poll on staging.