Design the endpoint that receives payment webhooks from a provider. Everything that can go wrong, and what you do about it.
Answer it out loud before you open anything. The value of the flags below is in comparing them to what you actually said.
The situation behind the question
Your service exposes POST /webhooks/payments. The provider retries on any non-2xx and does not guarantee ordering. Your handler currently parses JSON, updates the order, sends a receipt email, and returns 200.
What it is really testing
Whether the candidate treats inbound webhooks as untrusted, duplicated and unordered by default. The scenario's handler is wrong in four distinct ways and a senior candidate should find at least three without prompting.