Collection attempt authorization

Webhook event recording how an authorization resolved. It is emitted for every outcome — you approved, you declined, or Mono could not obtain a usable answer and applied the collection's failure_mode — and the attempt's authorization.outcome says which.

It fires exactly where the attempt carries an authorization object, so an attempt Mono never asked you about produces none: a collection without authorization, one Mono's own rules rejected before you were asked, or one Mono could not ask about at all because of an incident on its own side. A request that left Mono and never reached you does produce one, with authorization.failure_kind set to transport.

Two things make it worth consuming even though you answered the request yourself. Under fail_open the attempt continues to the bank as if you had approved it, and if the payment then settles its lifecycle webhook is indistinguishable from a real approval — this event is the only thing that tells them apart. And because it reports what Mono recorded, it closes the loop on a response of yours that was subtly malformed: from your side the request looked answered, while Mono resolved it through failure_mode.

The event goes out before the receiving bank has confirmed, so an approved here can still be followed by collection.attempt_unsuccessful — approving is not settling.

data is the collection and the attempt as they stand when this webhook is delivered, which for this event is normally before the bank has answered: expect the attempt in created, and the collection's paid_amount and successful_attempts not yet moved. It is delivered independently of the attempt's lifecycle webhook, so neither order is guaranteed; correlate the two by attempt.id.

This event is additional, never a replacement: the attempt's own lifecycle webhook still fires. It is opt-in per webhook subscription.