For the complete documentation index, see llms.txt. This page is also available as Markdown.

Webhooks

The goal of the webhooks is to give your organization a real time update on the status and events of users, transactions, products, invoices, subscriptions, taxes and common fees so you can automate your next call to action depending of the status of the payments or the occurrence of events.

To enable webhooks you have to open the settings page using the portal.

When a URL is defined, Zūm will send a POST request each time there is a status change or event triggered for:

  • Users (only available for customers)

  • Transactions (only available for customers)

  • Customers (only available for partners)

  • Recurrent Transaction (only available for customers)

  • Products (only available for customers)

  • Invoices (only available for customers)

  • Subscriptions (only available for customers)

  • Taxes (only available for customers)

  • Common Fees (only available for customers)

  • Insights (only available for customers)

  • Chargeback Action (only available for customers)

  • Aggregation Status (only available for customers)

  • Aggregation Transaction Events (only available for customers)

INFO

The payload has a property Type to indicate to each entity the webhook status change is coming from and also a property called Event that indicates the type of event that trigger the webhook.

Event

Event
Description
Availability

Created

Entity was created

Invoice, Subscription, Product, Tax Rate, Common Fee

Updated

Entity was updated on some manner

Invoice, Subscription, Product, Tax Rate, Common Fee

Deleted

Entity was deleted

Product

StatusChange

Entity had it's status changed

Invoice, Subscription, Product, Tax Rate, Common Fee

Completed

Entity was ready to use

Insights

Failed

Entity was not ready to use

Insights

NOTE

For now, transactions and user entities does not posses events to be associated with

Type

Type
Description

User

Indicates the webhook call is for a user status change

Transaction

Indicates the webhook call is for a transaction status change

Customer

Indicates the webhook call is for a customer account status change

Recurrent Transaction

Indicates the webhook call is for a recurrent transaction creation

Product

Indicates the webhook call is for a product event

Invoice

Indicates the webhook call is for a invoice event

Subscription

Indicates the webhook call is for a subscription event

TaxRate

Indicates the webhook call is for a tax rate event

CommonFee

Indicates the webhook call is for a common fee event

Insights

Indicates the webhook call is for a insights event

Type
Description

User

Indicates the webhook call is for a user status change

Transaction

Indicates the webhook call is for a transaction status change

Customer

Indicates the webhook call is for a customer account status change

Recurrent Transaction

Indicates the webhook call is for a recurrent transaction creation

Product

Indicates the webhook call is for a product event

Invoice

Indicates the webhook call is for a invoice event

Subscription

Indicates the webhook call is for a subscription event

TaxRate

Indicates the webhook call is for a tax rate event

CommonFee

Indicates the webhook call is for a common fee event

Insights

Indicates the webhook call is for a insights event

The webhook payload uses the same JSON format as the responses for the get User, Transaction, Product, Invoice, Subscription, Tax Rates, Common Fees and Insights.

The Chargeback webhook payload follows the JSON structure shown in the example response.

INFO

If you don't want to receive webhook for a specific status, then you can specify the status in the portal settings.

Verifying authenticity

When Zūm Rails sends data to external services (e.g. when triggering a webhook to a service owned by you), the payload will be authenticated with a hash-based message authentication code (HMAC).

The key used to create the HMAC is your Webhook Secret, and you verify it by running the algorithm yourself with the payload and the key to re-create the HMAC. Your Webhook Secret can be found in the portal under your settings.

The signature is always sent with the webhook in a header named zumrails-signature

You can verify the authenticity of the webhook response by using HMAC. The HMAC verification process is as follows:

  1. You receive a POST request via the webhook

  2. Your app computes a signature based on payload received, using your Webhook Secret

  3. You verify that your signature matches the zumrails-signature in the request

Here are the steps to validate a request coming from Zūm Rails You’ll need the zumrails-signature sent by the webhook and your key (which is your Webhook Secret):

  1. Retrieve the zumrails-signature header

  2. Retrieve json body of the request. Make sure you are not adding any new spaces or formats.

  3. Using HMAC SHA256 implemented in your programming language, calculate the signature in your side. The body is the payload and the secret is your Webhook Secret.

  4. Compare your hash with the value provided under the zumrails-signature in the request, they should match.

A few examples on how to calculate HMAC in different languages: https://github.com/danharper/hmac-examples

INFO

When generating the signature, make sure you are using the body received in the payload, as it is. Some languages might add spaces or tabs.

WE CALCULATE THE SIGNATURE MAKING SURE THE PAYLOAD IS IN UTF-8 CHARSET,

When generating the signature, make sure you are using the body received in the payload, as it is. Some languages might add spaces or tabs.

Retry in case of failure

In the event of a failure to deliver the webhook (!= 200) we will try again 3 times every 5 minutes in sandbox. In production we will retry 5 times every 60 minutes.

If you have anything specific in our retry policy, don't hesitate to talk with us, to support@zumrails.com, changes can be made.

Receiving users' financial institution details

For Interac transactions, you can now receive the end users' financial institution name and financial institution number which was used to complete the Interac requests. To receive this information, make sure you have configured the InteracSettledIntoWallet webhook event. (You can set this event by going to settings > webhook and API settings > Interac status change).

NOTE

In some cases the bank may return the same input provided on Zum Rails and not the name on the user’s account for the parameter "InteracDebtorFullName". This will result in the transaction going through successfully even when the name might not be a match. This is rare and the banks are working to improve on their end.

INFO

This information might not be available for all accounts. For any questions contact our support team

Chargeback webhook

The payload has a property Type to indicate to each entity the webhook status change is coming from and also a property called Event that indicates the type of event that trigger the webhook.

Event

Event
Description

AcceptedByUser

Chargeback was accepted by user.

AcceptedByDefault

Chargeback was accepted past due date.

Disputed

Chargeback was disputed by user.

Aggregation Transaction webhook

The webhook is triggered at the end of the aggregation process, once the user’s bank account transactions have been retrieved.

If the process completes successfully, the response payload will include all account and transaction data. In this case, there is no need to call the API to retrieve aggregation details, as all the required information is already provided in the webhook.

If the process fails, the webhook payload will include an error message describing the issue.

Event

Event
Description

Completed

Aggregation transaction scraping has been successfully completed. This event is triggered regardless of whether the process runs synchronously or asynchronously.

Failed

Aggregation transaction scraping has failed. This event is triggered only when the process runs asynchronously.

Response

Prepaid Card User webhook

Event

Type
Event
Description

PrepaidCardUser

OnboardIncomplete

Prepaid card application profile setup completed but did not complete the KYC/IDV step

PrepaidCardUser

OnboardInProgress

Prepaid card application verification started but not finished

PrepaidCardUser

OnboardApproval

Prepaid card application verification is successful and passed

PrepaidCardUser

OnboardDeclined

Prepaid card application is declined (same format as OnboardIncomplete)

PrepaidCardUser

OnboardUnderReview

Prepaid card application is under review (same format as OnboardIncomplete)

PrepaidCardUser

CardIssued

Prepaid card is issued to the approved user

PrepaidCardUser

CardActivated

Prepaid card is activated (same format as CardIssued)

PrepaidCardUser

CardStatusChanged

Prepaid card status change (same format as CardIssued)

PrepaidCardUser

CardProgramChanged

Prepaid card program change (same format as CardIssued)

PrepaidCardUser

CardReissue

Prepaid card is reissued (same format as CardIssued)

PrepaidCardUser

ProfileUpdate

Prepaid card profile change (same format as CardIssued)

PrepaidCardUser

LowBalanceAlert

Prepaid card has a low balance (same format as CardIssued)

Onboard Status

Type
Event
Card Verification Status

PrepaidCardUser

OnboardIncomplete

INCOMPLETE

PrepaidCardUser

OnboardInProgress

IN PROGRESS

PrepaidCardUser

OnboardApproval

APPROVED

PrepaidCardUser

OnboardDeclined

DECLINED

PrepaidCardUser

OnboardUnderReview

UNDER REVIEW

NOTE

The CardOnboardingSession parameter is a URL link to the card applicants IDV session and the link expires after 7 days based on the initial IDV session.

The card applicant can access the CardOnboardingSession URL anytime and after authentication, they will land on where they dropped off if the card application was not finished.

Once the card onboarding link expires, the cardholder's application has expired. The cardholder will need to re-apply from the beginning and a new card onboarding link will be generated.

Secured Credit Card User webhook

Event

Type
Event
Description

SecuredCreditCardUser

OnboardIncomplete

Card application profile setup completed but did not complete the KYC/IDV step

SecuredCreditCardUser

OnboardInProgress

Card application verification started but not finished

SecuredCreditCardUser

OnboardApproval

Card application verification is successful and passed

SecuredCreditCardUser

OnboardDeclined

Card application is declined (same format as OnboardIncomplete)

SecuredCreditCardUser

OnboardUnderReview

Card application is under review (same format as OnboardIncomplete)

SecuredCreditCardUser

CardIssued

Card is issued to the approved user

SecuredCreditCardUser

CardActivated

Caard is activated (same format as CardIssued)

SecuredCreditCardUser

CardStatusChanged

Card status change (same format as CardIssued)

SecuredCreditCardUser

CardProgramChanged

Card program change (same format as CardIssued)

SecuredCreditCardUser

CardReissue

Card is reissued (same format as CardIssued)

SecuredCreditCardUser

ProfileUpdate

Card profile change (same format as CardIssued)

SecuredCreditCardUser

CardAttributeUpdate

Card related attribute updates such as security deposit and credit limit changes (same format as CardIssued)

SecuredCreditCardUser

LowBalanceAlert

Card has a low available credit (same format as CardIssued)

Onboard Status

Type
Event
Card Verification Status

SecuredCreditCardUser

OnboardIncomplete

INCOMPLETE

SecuredCreditCardUser

OnboardInProgress

IN PROGRESS

SecuredCreditCardUser

OnboardApproval

APPROVED

SecuredCreditCardUser

OnboardDeclined

DECLINED

SecuredCreditCardUser

OnboardUnderReview

UNDER REVIEW

NOTE

The CardOnboardingSession parameter is a URL link to the card applicants IDV session and the link expires after 7 days based on the initial IDV session.

The card applicant can access the CardOnboardingSession URL anytime and after authentication, they will land on where they dropped off if the card application was not finished.

Once the card onboarding link expires, the cardholder's application has expired. The cardholder will need to re-apply from the beginning and a new card onboarding link will be generated.

Card Transaction webhook

Type
Event
Description

PrepaidCardTransaction /

SecuredCreditCardTransaction

NetworkDebit

Card network debit related financial transactions

PrepaidCardTransaction /

SecuredCreditCardTransaction

NetworkCredit

Card network credit related financial transactions (same format as NetworkDebit)

PrepaidCardTransaction /

SecuredCreditCardTransaction

NetworkDecline

Card network decline related financial transactions (same format as NetworkDebit)

PrepaidCardTransaction /

SecuredCreditCardTransaction

NonNetworkDebit

Card non-network debit related financial transactions

PrepaidCardTransaction /

SecuredCreditCardTransaction

NonNetworkCredit

Card non-network credit related financial transactions (same format as NonNetworkDebit)

PrepaidCardTransaction /

SecuredCreditCardTransaction

NonNetworkDecline

Card non-network decline related financial transactions (same format as NonNetworkDebit)

PrepaidCardTransaction /

SecuredCreditCardTransaction

TransactionReversal

Card transaction reversals (same format as NonNetworkDebit)

PrepaidCardTransaction /

SecuredCreditCardTransaction

InactiveCardFee

Card inactivity fee applied to the card

PrepaidCardTransaction /

SecuredCreditCardTransaction

OverdraftFee

Card overdraft fee applied to the card (same format as InactiveCardFee)

PrepaidCardTransaction /

SecuredCreditCardTransaction

LatePaymentFee

Card late payment fee applied to the card (same format as InactiveCardFee)

PrepaidCardTransaction /

SecuredCreditCardTransaction

MaintenanceFee

Card maintenance fee applied to the card (same format as InactiveCardFee)

PrepaidCardTransaction /

SecuredCreditCardTransaction

IssuingCardFee

Card issuing fee applied to the card (same format as InactiveCardFee)

PrepaidCardTransaction /

SecuredCreditCardTransaction

ActivatedFee

Card activation fee applied to the card (same format as InactiveCardFee)

PrepaidCardTransaction

WriteOff

Card is written off due to negative balance based on the Negative Balance rule

MessageType

Based on the Transaction object, you can determine the type of transaction based on the following Transaction.MessageType

Value
Description

0200

Posted Transaction Normal

0220

Posted Transaction Force Post

0400

Posted Transaction Reversal

0420

Posted Transaction Reversal

0100

Pending Transaction

0120

Pending Transaction

0720

Fee-based Transaction

0722

Fee-based Transaction

OTP webhook

OTP Event

The OtpExpiry parameter is in minutes.

Type
Event
Description

CardUserOTP

CardHolderPortalOtp

OTP for cardholder portal login

PrepaidCardOTP / SecuredCreditCardOTP

MobileWalletOtp

Prepaid card mobile wallet provisioning triggered an OTP request

PrepaidCardOTP / SecuredCreditCardOTP

ThreeDsOtp

Prepaid card online transaction triggered a 3DS OTP request (same format as MobileWalletOtp)

Card Statement webhook

The webhook is triggered when a card statement is generated for a secured credit card User.

Credit Trade Report webhook

The webhook is triggered when a Credit Trade Report record is generated for a secured credit card User.

Last updated

Was this helpful?