signedPayload

The single field in a V2 Server Notification's JSON body: the JWS containing the whole event. Because the signature covers this exact string, forwarding notifications to other systems only works if you relay the body verbatim; decoding and re-serializing breaks everyone's verification downstream.

Decoded, the payload (Apple calls it responseBodyV2DecodedPayload) always carries notificationType, an optional subtype, version, signedDate and notificationUUID. It then carries exactly one of four mutually exclusive objects: data for in-app purchase events, appData (for the RESCIND_CONSENT type), summary (for a RENEWAL_EXTENSION with the SUMMARY subtype), or externalPurchaseToken. Code that assumes data is always present will throw on the other three.

notificationUUID is the dedupe key. Apple retries deliveries it considers failed, so the same notification can arrive more than once.

See: Forwarding notifications correctly →