Webhook
A request another company's server sends to yours when something happens, such as a payment clearing. It's an API call the other way round: you give them a URL and wait. Anyone who finds that URL can send to it too.
An agent's first version usually trusts the request, handles it once and does all the work before replying. All three are wrong: anyone can send to that URL, real senders repeat themselves, and they give up if you are slow. A demo sends one honest event, so spell out what you need.
“Verify the Stripe-Signature against the raw request body before doing anything, and reject events over 5 minutes old. Log each event id and skip ones already handled. Return 200 straight away and queue the work. Test it with stripe listen --forward-to localhost:4242/webhook.”