How to secure payment API for App Store?

Question

Apple Developer Program

Apparently they don't have a callback for fail and successful payments, or am I missing something?
After all, if you make an open api for updating an order for PAID, this is a vulnerability that is easy to exploit.
That is, the order is made, it is enough to log in, know what data and to which api point to send and that's it.