Webhook Events

Events pushed to your endpoint, and how to verify the signature.

Register an HTTPS endpoint under Developer › Webhooks and Payonclick pushes these events as they happen, so you do not have to poll.

Event	Trigger	Payload fields
`transfer.success`	Transfer credited	txn_id, amount, beneficiary_id, timestamp
`transfer.failed`	Transfer failed or returned	txn_id, amount, reason, timestamp
`transfer.pending`	Transfer under processing	txn_id, amount, timestamp
`beneficiary.added`	New beneficiary added	beneficiary_id, account_number, ifsc
`beneficiary.deleted`	Beneficiary removed	beneficiary_id
`bill.success`	BBPS bill paid	reference_id, client_reference, amount, biller_id, bbps_txn_id
`bill.failed`	BBPS payment failed (wallet auto-refunded)	reference_id, client_reference, amount, message
`bill.pending`	BBPS payment awaiting biller confirmation	reference_id, client_reference, amount

Verifying a delivery

Deliveries are signed with your webhook secret in the X-POC-Signature header as sha256=<hmac>, computed over the raw body. Verify it before trusting the payload.

import hmac, hashlib

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest("sha256=" + expected, header)

📘

Respond 2xx quickly

Acknowledge the delivery first and process it afterwards. A slow or failing endpoint is retried, and repeated failures raise the failure count on the webhook until an operator disables it.