Payment Callback

When user complate a payment. The payment gateway notify the merchant via webhook (URL specified when create a payment order) Using POST request with Content-Type: application/json to merchant's notify URL with below data. The singature is sent in the header X-Signature. Clients need to verify the signature before further processing.

Method : POST

Callback Data

{
    "merchant_id" : "[merchant id]",
    "platform_order_id" : "[platform order id]",
    "client_order_id" : "[merchant order id]",
    "mode" : "PAYMENT",
    "amount" : "[amount]",
    "status" : "PAID",
    "timestamp" : [timestamp]
}

Explainations

CANCELLED is sent when the customer cancels the order on the payment page. A cancel may not be final — in some cases the order can still be completed afterwards, in which case you will receive a subsequent PAID callback for the same platform_order_id. Always treat PAID as authoritative.

Complete HTTP Request Example

POST /callback HTTP/1.1
Content-Type: application/json
Connection: Close
X-Signature: b6f9dd313cde39ae1b87e63b9b457029bcea6e9520b5db5de20d3284e4c0259e

{
    "merchant_id" : "AA12345678",
    "platform_order_id" : "THBP2024042821130xxxxxxxxx",
    "client_order_id" : "ORDER0123456789789445566",
    "mode" : "PAYMENT",
    "amount" : "1000.00",
    "status" : "PAID",
    "timestamp" : 112233445566
}

Callback Handling

To ensure correct handling of callbacks from the payment gateway, please implement your webhook processing with the following considerations:

HTTP Status 200 Response:Your system must respond with HTTP status code 200 upon successful receipt and processing of the callback. If the payment gateway does not receive a 200 response, the callback will be retried after a delay until a successful acknowledgment is received.

Handling Duplicate Callbacks (Idempotency):It's standard practice and normal for duplicate callbacks to occur. Ensure your system verifies each callback using platform_order_id or client_order_id before processing. Implement your logic so that repeated callbacks do not cause duplicate actions or financial transactions.

These steps follow industry-standard practices for webhook implementations and ensure robust and reliable callback processing.