A webhook is the opposite of the API. Instead of your system asking every so often whether there's been a sale, the platform notifies you the instant the event happens, sending the data to an address you registered.
It's what makes delivery immediate: an approved sale triggers access being granted, a refund triggers its removal.
Two rules avoid most problems. Verify the HMAC signature before trusting the notification, and handle re-sends of the same event without duplicating the effect, because the platform repeats the call when it doesn't receive confirmation.