{
"api_version": "2026-10-31",
"created_at": "2026-10-10T10:00:00.000Z",
"data": {
"paymentData": {},
"transaction": {
"action": "SALE",
"amount": "12.30",
"createdAt": "2026-10-10T09:59:00.000Z",
"currency": "EUR",
"id": "tr_example",
"livemode": true,
"orderId": "order_example_001",
"status": "SUCCESS"
}
},
"id": "evt_0j7s2pft4v8b9t8nj2cra1eg00",
"livemode": true,
"type": "transaction.updated"
}Transaction status event
OrsunPay sends this POST to the transaction callbackUrl after a status update. Verify HMAC-SHA256 over the exact raw body before parsing, using the merchant webhook secret (ADR-010). Reject signature timestamps beyond 300 seconds; compare in constant time. Deliveries are at least once and can arrive out of order. Deduplicate by the signed body id. Secret rotation takes effect immediately (no dual signing); failed deliveries retry for approximately 31 hours. API keys are not sent with webhooks.
{
"api_version": "2026-10-31",
"created_at": "2026-10-10T10:00:00.000Z",
"data": {
"paymentData": {},
"transaction": {
"action": "SALE",
"amount": "12.30",
"createdAt": "2026-10-10T09:59:00.000Z",
"currency": "EUR",
"id": "tr_example",
"livemode": true,
"orderId": "order_example_001",
"status": "SUCCESS"
}
},
"id": "evt_0j7s2pft4v8b9t8nj2cra1eg00",
"livemode": true,
"type": "transaction.updated"
}Headers
t=,v1=<hex HMAC-SHA256(timestamp + "." + exact raw body)>; never log this header
^t=[0-9]+,v1=[a-f0-9]{64}$Convenience copy of body id (evt_…); deduplicate only after verifying the signed body
^evt_[0-7][0-9a-hjkmnp-tv-z]{25}$Convenience copy of body type
"transaction.updated"
Body
Signed merchant event envelope (ADR-005/010). Event id and created_at remain unchanged on retries. Additional fields and event types may be added.
Payload version, fixed for the event (retries and re-drives keep it). Current: 2026-10-31. See the webhook event catalogue.
^[0-9]{4}-[0-9]{2}-[0-9]{2}$"2026-10-31"
UTC time when the event was recorded, not delivery time
Show child attributes
Show child attributes
Stable event identifier (TypeID with prefix evt_); identical on every retry and re-drive. Use the signed body id for deduplication
^evt_[0-7][0-9a-hjkmnp-tv-z]{25}$"evt_0j7s2pft4v8b9t8nj2cra1eg00"
Mode of the transaction snapshot; false for sandbox.
Payment status event type; refund events use RefundWebhookEvent
"transaction.updated"
Response
Any 2xx acknowledges delivery. Response body is ignored but must be empty or at most 64 KiB (MERCHANT_WEBHOOK_MAX_RESPONSE_BYTES); a larger body fails the delivery attempt. Prefer HTTP 204 No Content.