Deliver a JSON event to the merchant HTTPS endpoint
Webhook
POST with Content-Type application/json and the {id, type, data} envelope. MuPag-Signature and the X-Gateway-Signature alias carry t=<epoch>,v1=<hmac>. The request also sends X-Gateway-Event-Id and X-Gateway-Timestamp. Success is 200-299. There is no User-Agent, and redirects are not followed. An SSRF-blocked target produces internal status 0, which is not an HTTP response, and the delivery is abandoned.
Request
Responses
- 408
- 425
- 429
- 2XX
- 3XX
- 4XX
- 5XX
Retryable status.
Retryable status.
Retryable status.
Any 200-299 status completes the delivery.
A redirect is not followed and the delivery is abandoned.
Other 4xx statuses abandon the delivery.
Status 500-599, including transport failure 599, is retryable.
Did this page unblock the next step?
Feedback stays inside the docs flow and should never include customer or card data.