Webhooks

Card operation and transaction event webhook notifications with signature verification.

The system pushes card operation and transaction events in real-time to the merchant's configured callback URL.

Common Specifications

Push Request Headers

HeaderTypeRequiredDescription
Content-TypeStringYesapplication/json;charset=UTF-8
X-Event-TypeStringYesEvent type identifier

Push Payload Structure

The push payload is a JSON object with business fields and sign at the same level:

{
  "<business_field_1>": "...",
  "<business_field_2>": "...",
  "sign": "<signature_value>"
}

Merchant Response Requirements

The merchant callback must return the following JSON structure:

FieldTypeDescription
respCodeStringResponse code, return 20000 to confirm receipt
respMsgStringResponse message

Card Operation Event

Pushed when card operations (creation, freeze, unfreeze, deposit, etc.) change status.

ItemDetails
X-Event-TypecardOperateRecordEvent

Push Parameters

FieldTypeDescription

merchantNo

Long

Target merchant number

operateRecordId

Long

Operation record ID

cardId

Long

Card ID

clientRequestId

String

Idempotent request ID

type

String

Operation type

status

String

Operation status

amount

BigDecimal

Amount

currency

String

Currency

feeList[]

Array

Fee detail list

feeList[].feeAmount

BigDecimal

Fee amount

feeList[].feeCurrency

String

Fee currency

sign

String

Signature value

Push Example

{
  "merchantNo": 88888,
  "operateRecordId": 200001,
  "cardId": 100001,
  "clientRequestId": "REQ_20260101_001",
  "type": "DEPOSIT",
  "status": "SUCCESS",
  "remark": null,
  "amount": 100.00,
  "currency": "USD",
  "feeList": [
    { "feeAmount": 1.00, "feeCurrency": "USD" }
  ],
  "sign": "a1b2c3d4e5f6..."
}

Transaction Event

Pushed when transactions (authorization, clearing, refund, etc.) occur.

ItemDetails
X-Event-TypetransactionEvent

Push Parameters

FieldTypeDescription

txnType

String

Transaction type: AUTHORIZATION / REVERSAL / CLEARING / REFUND / VERIFICATION

txnStatus

String

Transaction status: S Success / F Failed / P Processing

txnOrderNo

String

Transaction order number

originTxnOrderNo

String

Original transaction order number

originTxnOrderNoForRefund

String

Original payment order number for refund

cardNo

String

Card number (masked)

transactionAmount

BigDecimal

Transaction amount

transactionCurrency

String

Transaction currency

transactionTime

Long

Transaction time (timestamp, milliseconds)

cardAmount

BigDecimal

Card amount

cardCurrency

String

Card currency

settleAmount

BigDecimal

Settlement amount

settleCurrency

String

Settlement currency

transactionFee

BigDecimal

Transaction fee

crossBorderFee

BigDecimal

Cross-border fee

exchangeFee

BigDecimal

Exchange fee

merchantName

String

Merchant name

merchantCountryCode

String

Merchant country code

merchantMccCode

String

Merchant MCC code

sign

String

Signature value

The full push payload also includes authTime, authorizationCode, authMessageDesc, settleTime, fee currency fields, and merchant address details. See the push example for all fields.

Push Example

{
  "txnType": "CHARGE",
  "txnStatus": "S",
  "txnOrderNo": "TXN20260101001",
  "originTxnOrderNo": null,
  "originTxnOrderNoForRefund": null,
  "cardNo": "411111******1111",
  "authTime": 1735689600000,
  "authorizationCode": "AUTH001",
  "authMessageDesc": "Approved",
  "transactionAmount": 50.00,
  "transactionCurrency": "USD",
  "transactionTime": 1735689600000,
  "cardAmount": 50.00,
  "cardCurrency": "USD",
  "settleAmount": 50.00,
  "settleCurrency": "USD",
  "settleTime": 1735776000000,
  "transactionFee": 0.50,
  "transactionFeeCurrency": "USD",
  "crossBorderFee": null,
  "crossBorderFeeCurrency": null,
  "exchangeFee": null,
  "exchangeFeeCurrency": null,
  "merchantId": "MCH001",
  "merchantName": "Amazon",
  "merchantCountry": "United States",
  "merchantCountryCode": "US",
  "merchantStateProvince": "WA",
  "merchantCity": "Seattle",
  "merchantPostalCode": "98101",
  "merchantMccCode": "5411",
  "sign": "a1b2c3d4e5f6..."
}

Signature Mechanism

Signing Process

  1. Serialize the push payload (excluding the sign field) as a JSON string
  2. Parse the top-level JSON fields, ignore fields with null values, place remaining fields into a TreeMap<String, String> (sorted by key ASCII order), and sign with the private key
  3. Append the signature result as the sign field to the payload, then serialize as the final request body

Key Points

  • Signed content: all non-null top-level fields in the payload, sorted by key in ASCII ascending order
  • The sign field itself is not included in the signature calculation (appended only after signing)