Webhook event payload for account.application.authorized / account.application.deauthorized has incorrect API version

[clement911]

Even though our webhook endpoints are pinned to a specific API version, whenever we received events for account.application.authorized / account.application.deauthorized , it seems that the api version field has the value of the account that is being authorized/deauthorized instead of the value of our pinned webhook API version.

[gabrielhurley-stripe]

Thanks for the report! We're tracking the issue internally; it's a bug on our end. I don't have an ETA for the fix, but it is on our list.

[clement911]

Just circling to check if there is any progress on this issue?

It's definitely very counter intuitive.

[gabrielhurley-stripe]

Unfortunately I still don't have an ETA. The issue is owned by another team and this hasn't made it into their current prioritization yet. I've bumped the ticket internally to see if they can move it up.

[matthew-macgregor]

We've encountered this issue as well. @clement911, thanks for submitting this issue, and did you find a reasonable workaround?

Is there any progress on resolving this, @gabrielhurley-stripe?

[bensontrent]

I don't see this as a bug as we perform actions on the user's invoice metadata to indicate if the item is unshipped. We require the user's API version to perform the correct action on our connected accounts. For example:

import Stripe from 'stripe'

const stripe = new Stripe(process.env.STRIPE_API_KEY!);


// Receive event here with additional logic

const perhapsMarkInvoiceUnshipped = async (event: Stripe.Event) => {

  if (event.type === 'invoice.created' && event.account && event.api_version) {

    if (event.data.object.shipping_cost) {
      await markInvoiceAsUnshipped(event.account, event.data.object.id, event.api_version)
    }
  }

}

const markInvoiceAsUnshipped = async (accountId: string, invoiceId: string, apiVersion: string) => {

  const invoice = await stripe.invoices.update(invoiceId,
    {
      metadata: {
        "ship_status": "unshipped"
      }
    },
    {
      stripeAccount: accountId,
      apiVersion: apiVersion
    }
  );
}

[matthew-macgregor]

Thanks for the example. We'll take a closer look. For more information, we are using the Stripe dotnet library.

At least in the dotnet client, the API Version field is validated during deserialization and throws an exception on API Version mismatch. There is a flag available to override this behavior, but I think we actually want this validation to occur. The official advice is to pin SDK version and API version, as seen here: https://docs.stripe.com/api/versioning

Because stripe-dotnet is strongly typed, the requests you send align with the API version current at your stripe-dotnet version’s release time. If you want to use a newer or older API version, consider upgrading or downgrading your stripe-dotnet version. Use the stripe-dotnet changelog to find which versions include the API version you need.

Example of the exception:

Received event with API version 2017-06-05, but Stripe.net 43.0.0 expects API version 2023-10-16. We recommend that you create a WebhookEndpoint with this API version. Otherwise, you can disable this exception by passing `throwOnApiVersionMismatch: false` to `Stripe.EventUtility.ParseEvent` or `Stripe.EventUtility.ConstructEvent`, but be wary that objects may be incorrectly deserialized.

I think it still should be classified as a bug based on this.

[clement911]

This is definitely a bug and it is has nothing to do with invoices or with the .NET library.
Webhook endpoints are pinned to a specific API version and Stripe is supposed to use that version when sending events. That's all there is to understand.