## Every purchase reaches your integrations

If you have a webhook endpoint subscribed to `pass.activated` or
`payment.succeeded`, it now receives:

- `pass.activated` once for every pass a client buys online: one-off passes, 0 kr
  introductory offers, memberships (when the first payment or the card step
  completes) and offers paid partly with account credit;
- `payment.succeeded` once for every successful charge, marked `initial`,
  `renewal`, `addon`, `registration_fee` or `membership_change`.

Each event is sent once, even when the payment confirmation and Stripe both
report the same purchase. A one-off pass purchase now says
`activation_type: purchase` (it said `one_time`); count purchases on
`activation_type: purchase` only, since `pass.activated` also reports other
activations such as a first visit.

## Where the buyer came from

Your website must send the visitor's freshly read checkout choice before campaign
details or a same-venue signup campaign can accompany the purchase event. A
positive permission window lasts at most 15 minutes near the original purchase;
delayed callbacks, older or unmappable attempts may have no attribution. The
purchase itself continues when attribution is unavailable. Click and marketing
browser values require current marketing consent; share with ad platforms only
when `attribution.consent.marketing` is true.

Websites must turn local tracking off immediately on withdrawal and save the
downgrade for any active original checkout, including a payment already started.
Until the server confirms saving it, show pending and retry that same choice.
Accepted denial prevents a late old consent snapshot reopening that checkout.
An unsaved withdrawal is not confirmed. Accepted denial governs fresh permission
checks; a capture already in flight under a previous read cannot be retracted,
nor can already claimed or forwarded events be unsent. No new financial attempt is needed for a privacy change.

Nothing changes for your clients: no new emails or messages are sent.