Each payment event fans out to every ACTIVE subscription for the payment's tenant whose subscribed types include it, signed with the subscription's secret via X-Hub-Signature-256. The CRM's “Register webhook” action creates one of these automatically.