Transfermate will send payment status notifications when the Payment status has been changed.
The payload will be sent via HTTP POST method and content type: application/x-www-form-urlencoded to an endpoint specified by the clients in the initial account setup.
The endpoint must respond with an HTTP Status Code: 200 OK, otherwise the Webhook Service will attempt to resend the message up to 5 times.

Prerequisites:

1. A Default Webhook URL to which Transfermate Education will send the notifications. This URL can be changed per each payment request if the webhook_url is provided in the MakeAPayment/InvoicePayment request.
2. Order ID – The Order ID has to be provided per each payment submitted via the MakeAPayment/InvoicePayment request, otherwise the notifications will not be triggered.
3. A Secret Key known by both parties – This key will be generated for your sandbox and production environment by Transfermate and sent to you via secure communication channel.
   If you didn’t receive you Secret Key yet, please contact Transfermate.

How to verify the integrity and the authenticity of a webhook message:

1. Remove all parameters which contains empty values from the message.
2. Remove hmac_signature parameter from the message.
3. Sort the remaining parameters lexicographically in ascending order. (Based on the key)
4. Separate the remaining parameter’s values using colons (:)
5. Apply the HMAC-SHA256 algorithm to the string produced in Step 4.
6. Compare the computed HMAC with the hmac_signature value. TME always uses lower-case hex characters.

Example:
Message Payload: param_4=value_4&param_3=value_3&param2=&param_1=0&hmac_signature=f2b5eb73adc34c1d46d112803c8cc7a8e1794fc2234755b9f89e8ad8cdedf068
Secret Key: !TestSecret123!
Plain String (after step 4): 0:value_3:value_4
HMAC-SHA256 [Plain Text, Secret Key] = f2b5eb73adc34c1d46d112803c8cc7a8e1794fc2234755b9f89e8ad8cdedf068

Webhook Notification Parameters

Context TRANSACTION: In addition to the above statuses, TransferMate can also forward 3rd party statuses (Credit Card & APM’s statuses) when the payment flow is Redirect. Please note that the third-party statuses will be sent to your endpoint with a context of 3RDPTY so you can differentiate between a TransferMate transaction status and a third-party status.

• Context - TRANSACTION
• Context - 3RDPTY