Webhooks
The goal of the webhooks is to give your organization a real time update on the status and events of users, transactions, products, invoices, subscriptions, taxes and common fees so you can automate your next call to action depending of the status of the payments or the occurrence of events.
To enable webhooks you have to open the settings page using the portal.

When a URL is defined, Zūm will send a POST request each time there is a status change or event triggered for:
Users (only available for customers)
Transactions (only available for customers)
Customers (only available for partners)
Recurrent Transaction (only available for customers)
Products (only available for customers)
Invoices (only available for customers)
Subscriptions (only available for customers)
Taxes (only available for customers)
Common Fees (only available for customers)
Insights (only available for customers)
Chargeback Action (only available for customers)
Aggregation Status (only available for customers)
Aggregation Transaction Events (only available for customers)
INFO
The payload has a property Type to indicate to each entity the webhook status change is coming from and also a property called Event that indicates the type of event that trigger the webhook.
Event
Created
Entity was created
Invoice, Subscription, Product, Tax Rate, Common Fee
Updated
Entity was updated on some manner
Invoice, Subscription, Product, Tax Rate, Common Fee
Deleted
Entity was deleted
Product
StatusChange
Entity had it's status changed
Invoice, Subscription, Product, Tax Rate, Common Fee
Completed
Entity was ready to use
Insights
Failed
Entity was not ready to use
Insights
NOTE
For now, transactions and user entities does not posses events to be associated with
Type
User
Indicates the webhook call is for a user status change
Transaction
Indicates the webhook call is for a transaction status change
Customer
Indicates the webhook call is for a customer account status change
Recurrent Transaction
Indicates the webhook call is for a recurrent transaction creation
Product
Indicates the webhook call is for a product event
Invoice
Indicates the webhook call is for a invoice event
Subscription
Indicates the webhook call is for a subscription event
TaxRate
Indicates the webhook call is for a tax rate event
CommonFee
Indicates the webhook call is for a common fee event
Insights
Indicates the webhook call is for a insights event
User
Indicates the webhook call is for a user status change
Transaction
Indicates the webhook call is for a transaction status change
Customer
Indicates the webhook call is for a customer account status change
Recurrent Transaction
Indicates the webhook call is for a recurrent transaction creation
Product
Indicates the webhook call is for a product event
Invoice
Indicates the webhook call is for a invoice event
Subscription
Indicates the webhook call is for a subscription event
TaxRate
Indicates the webhook call is for a tax rate event
CommonFee
Indicates the webhook call is for a common fee event
Insights
Indicates the webhook call is for a insights event
Transaction
Indicates the webhook call is for a transaction status change
Customer
Indicates the webhook call is for a customer account status change
Chargeback Action
Indicates the webhook call is for a transaction chargeback status change
The webhook payload uses the same JSON format as the responses for the get User, Transaction, Product, Invoice, Subscription, Tax Rates, Common Fees and Insights.
The Chargeback webhook payload follows the JSON structure shown in the example response.
INFO
If you don't want to receive webhook for a specific status, then you can specify the status in the portal settings.
Verifying authenticity
When Zūm Rails sends data to external services (e.g. when triggering a webhook to a service owned by you), the payload will be authenticated with a hash-based message authentication code (HMAC).
The key used to create the HMAC is your Webhook Secret, and you verify it by running the algorithm yourself with the payload and the key to re-create the HMAC. Your Webhook Secret can be found in the portal under your settings.
The signature is always sent with the webhook in a header named zumrails-signature
You can verify the authenticity of the webhook response by using HMAC. The HMAC verification process is as follows:
You receive a POST request via the webhook
Your app computes a signature based on payload received, using your Webhook Secret
You verify that your signature matches the zumrails-signature in the request
Here are the steps to validate a request coming from Zūm Rails You’ll need the zumrails-signature sent by the webhook and your key (which is your Webhook Secret):
Retrieve the zumrails-signature header
Retrieve json body of the request. Make sure you are not adding any new spaces or formats.
Using HMAC SHA256 implemented in your programming language, calculate the signature in your side. The body is the payload and the secret is your Webhook Secret.
Compare your hash with the value provided under the zumrails-signature in the request, they should match.
A few examples on how to calculate HMAC in different languages: https://github.com/danharper/hmac-examples
INFO
When generating the signature, make sure you are using the body received in the payload, as it is. Some languages might add spaces or tabs.
WE CALCULATE THE SIGNATURE MAKING SURE THE PAYLOAD IS IN UTF-8 CHARSET,
When generating the signature, make sure you are using the body received in the payload, as it is. Some languages might add spaces or tabs.
CAUTION
When generating the signature, make sure you are using the body received in the payload, as it is. Some languages might add spaces or tabs.
CAUTION
We calculate the signature when the payload is in UTF-8 charset, so make sure it is the same on your side, or else the signatures won't match.
Retry in case of failure
In the event of a failure to deliver the webhook (!= 200) we will try again 3 times every 5 minutes in sandbox. In production we will retry 5 times every 60 minutes.
If you have anything specific in our retry policy, don't hesitate to talk with us, to support@zumrails.com, changes can be made.
Receiving users' financial institution details
For Interac transactions, you can now receive the end users' financial institution name and financial institution number which was used to complete the Interac requests. To receive this information, make sure you have configured the InteracSettledIntoWallet webhook event. (You can set this event by going to settings > webhook and API settings > Interac status change).
NOTE
In some cases the bank may return the same input provided on Zum Rails and not the name on the user’s account for the parameter "InteracDebtorFullName". This will result in the transaction going through successfully even when the name might not be a match. This is rare and the banks are working to improve on their end.
INFO
This information might not be available for all accounts. For any questions contact our support team
Chargeback webhook
The payload has a property Type to indicate to each entity the webhook status change is coming from and also a property called Event that indicates the type of event that trigger the webhook.
Event
AcceptedByUser
Chargeback was accepted by user.
AcceptedByDefault
Chargeback was accepted past due date.
Disputed
Chargeback was disputed by user.
Aggregation Transaction webhook
The webhook is triggered at the end of the aggregation process, once the user’s bank account transactions have been retrieved.
If the process completes successfully, the response payload will include all account and transaction data. In this case, there is no need to call the API to retrieve aggregation details, as all the required information is already provided in the webhook.
If the process fails, the webhook payload will include an error message describing the issue.
Event
Completed
Aggregation transaction scraping has been successfully completed. This event is triggered regardless of whether the process runs synchronously or asynchronously.
Failed
Aggregation transaction scraping has failed. This event is triggered only when the process runs asynchronously.
Response
Prepaid Card User webhook
Event
PrepaidCardUser
OnboardIncomplete
Prepaid card application profile setup completed but did not complete the KYC/IDV step
PrepaidCardUser
OnboardInProgress
Prepaid card application verification started but not finished
PrepaidCardUser
OnboardApproval
Prepaid card application verification is successful and passed
PrepaidCardUser
OnboardDeclined
Prepaid card application is declined (same format as OnboardIncomplete)
PrepaidCardUser
OnboardUnderReview
Prepaid card application is under review (same format as OnboardIncomplete)
PrepaidCardUser
CardIssued
Prepaid card is issued to the approved user
PrepaidCardUser
CardActivated
Prepaid card is activated (same format as CardIssued)
PrepaidCardUser
CardStatusChanged
Prepaid card status change (same format as CardIssued)
PrepaidCardUser
CardProgramChanged
Prepaid card program change (same format as CardIssued)
PrepaidCardUser
CardReissue
Prepaid card is reissued (same format as CardIssued)
PrepaidCardUser
ProfileUpdate
Prepaid card profile change (same format as CardIssued)
PrepaidCardUser
LowBalanceAlert
Prepaid card has a low balance (same format as CardIssued)
Onboard Status
PrepaidCardUser
OnboardIncomplete
INCOMPLETE
PrepaidCardUser
OnboardInProgress
IN PROGRESS
PrepaidCardUser
OnboardApproval
APPROVED
PrepaidCardUser
OnboardDeclined
DECLINED
PrepaidCardUser
OnboardUnderReview
UNDER REVIEW
NOTE
The CardOnboardingSession parameter is a URL link to the card applicants IDV session and the link expires after 7 days based on the initial IDV session.
The card applicant can access the CardOnboardingSession URL anytime and after authentication, they will land on where they dropped off if the card application was not finished.
Once the card onboarding link expires, the cardholder's application has expired. The cardholder will need to re-apply from the beginning and a new card onboarding link will be generated.
Secured Credit Card User webhook
Event
SecuredCreditCardUser
OnboardIncomplete
Card application profile setup completed but did not complete the KYC/IDV step
SecuredCreditCardUser
OnboardInProgress
Card application verification started but not finished
SecuredCreditCardUser
OnboardApproval
Card application verification is successful and passed
SecuredCreditCardUser
OnboardDeclined
Card application is declined (same format as OnboardIncomplete)
SecuredCreditCardUser
OnboardUnderReview
Card application is under review (same format as OnboardIncomplete)
SecuredCreditCardUser
CardIssued
Card is issued to the approved user
SecuredCreditCardUser
CardActivated
Caard is activated (same format as CardIssued)
SecuredCreditCardUser
CardStatusChanged
Card status change (same format as CardIssued)
SecuredCreditCardUser
CardProgramChanged
Card program change (same format as CardIssued)
SecuredCreditCardUser
CardReissue
Card is reissued (same format as CardIssued)
SecuredCreditCardUser
ProfileUpdate
Card profile change (same format as CardIssued)
SecuredCreditCardUser
CardAttributeUpdate
Card related attribute updates such as security deposit and credit limit changes (same format as CardIssued)
SecuredCreditCardUser
LowBalanceAlert
Card has a low available credit (same format as CardIssued)
Onboard Status
SecuredCreditCardUser
OnboardIncomplete
INCOMPLETE
SecuredCreditCardUser
OnboardInProgress
IN PROGRESS
SecuredCreditCardUser
OnboardApproval
APPROVED
SecuredCreditCardUser
OnboardDeclined
DECLINED
SecuredCreditCardUser
OnboardUnderReview
UNDER REVIEW
NOTE
The CardOnboardingSession parameter is a URL link to the card applicants IDV session and the link expires after 7 days based on the initial IDV session.
The card applicant can access the CardOnboardingSession URL anytime and after authentication, they will land on where they dropped off if the card application was not finished.
Once the card onboarding link expires, the cardholder's application has expired. The cardholder will need to re-apply from the beginning and a new card onboarding link will be generated.
Card Transaction webhook
PrepaidCardTransaction /
SecuredCreditCardTransaction
NetworkDebit
Card network debit related financial transactions
PrepaidCardTransaction /
SecuredCreditCardTransaction
NetworkCredit
Card network credit related financial transactions (same format as NetworkDebit)
PrepaidCardTransaction /
SecuredCreditCardTransaction
NetworkDecline
Card network decline related financial transactions (same format as NetworkDebit)
PrepaidCardTransaction /
SecuredCreditCardTransaction
NonNetworkDebit
Card non-network debit related financial transactions
PrepaidCardTransaction /
SecuredCreditCardTransaction
NonNetworkCredit
Card non-network credit related financial transactions (same format as NonNetworkDebit)
PrepaidCardTransaction /
SecuredCreditCardTransaction
NonNetworkDecline
Card non-network decline related financial transactions (same format as NonNetworkDebit)
PrepaidCardTransaction /
SecuredCreditCardTransaction
TransactionReversal
Card transaction reversals (same format as NonNetworkDebit)
PrepaidCardTransaction /
SecuredCreditCardTransaction
InactiveCardFee
Card inactivity fee applied to the card
PrepaidCardTransaction /
SecuredCreditCardTransaction
OverdraftFee
Card overdraft fee applied to the card (same format as InactiveCardFee)
PrepaidCardTransaction /
SecuredCreditCardTransaction
LatePaymentFee
Card late payment fee applied to the card (same format as InactiveCardFee)
PrepaidCardTransaction /
SecuredCreditCardTransaction
MaintenanceFee
Card maintenance fee applied to the card (same format as InactiveCardFee)
PrepaidCardTransaction /
SecuredCreditCardTransaction
IssuingCardFee
Card issuing fee applied to the card (same format as InactiveCardFee)
PrepaidCardTransaction /
SecuredCreditCardTransaction
ActivatedFee
Card activation fee applied to the card (same format as InactiveCardFee)
PrepaidCardTransaction
WriteOff
Card is written off due to negative balance based on the Negative Balance rule
MessageType
Based on the Transaction object, you can determine the type of transaction based on the following Transaction.MessageType
0200
Posted Transaction Normal
0220
Posted Transaction Force Post
0400
Posted Transaction Reversal
0420
Posted Transaction Reversal
0100
Pending Transaction
0120
Pending Transaction
0720
Fee-based Transaction
0722
Fee-based Transaction
OTP webhook
OTP Event
The OtpExpiry parameter is in minutes.
CardUserOTP
CardHolderPortalOtp
OTP for cardholder portal login
PrepaidCardOTP / SecuredCreditCardOTP
MobileWalletOtp
Prepaid card mobile wallet provisioning triggered an OTP request
PrepaidCardOTP / SecuredCreditCardOTP
ThreeDsOtp
Prepaid card online transaction triggered a 3DS OTP request (same format as MobileWalletOtp)
Card Statement webhook
The webhook is triggered when a card statement is generated for a secured credit card User.
Credit Trade Report webhook
The webhook is triggered when a Credit Trade Report record is generated for a secured credit card User.
Last updated
Was this helpful?
