Webhook payloads

Field-level reference for the event objects Kashier sends. For endpoint setup, acknowledgement, and signature verification, see the Webhooks guide.

Events

The event field is the transaction operation, set verbatim. Events:

• pay
• authorize
• capture
• refund
• partial_refund
• void
• reject
• reversal

These are the values Kashier sets on a delivered event. The set you can subscribe a configured webhook to is narrower — see Create a webhook.

Event payload

Each event is structured as an Event object with a data payload that contains the transaction details.

{
  "event": "pay",
  "data": {
      "merchantOrderId": "1642935044835",
      "kashierOrderId": "efb3d440-e3bf-4c86-b98e-c7bb1cbbcca1",
      "orderReference": "TEST-ORD-33581",
      "transactionId": "TX-249893122",
      "status": "SUCCESS",
      "method": "card",
      "creationDate": "2022-01-23T10:50:54.261Z",
      "amount": 11334,
      "currency": "EGP",
      "card": {
      "cardInfo": {
          "cardHolderName": "John Doe",
          "cardBrand": "Mastercard",
          "maskedCard": "511111******1118"
      },
      "merchant": { "merchantRedirectURL": "http://localhost:9000/callback" },
      "amount": 11334,
      "currency": "EGP"
      },
      "metaData": { "time": "2022-01-23T10:50:52.562Z" },
      "transactionResponseCode": "00",
      "transactionResponseMessage": { "en": "Approved", "ar": "تمت الموافقة" },
      "channel": "online | e-commerce",
      "merchantDetails": { "businessEmail": "[email protected]" },
      "signatureKeys": [
      "amount",
      "channel",
      "currency",
      "kashierOrderId",
      "merchantOrderId",
      "method",
      "orderReference",
      "status",
      "transactionId",
      "transactionResponseCode"
      ],
      "platform": {}
  }
}

Field notes

• merchantOrderId — pass this key back to Kashier to reconcile your orders. Learn more about order reconciliation.
• settlementInfo — per-transaction fee and settlement reconciliation block: vat, sellingRate, sellingFlat, totalSellingRate, totalSellingFees, settledAmount.
• posSerialNumber, posTerminalId, posBranchName — identify the physical POS device, terminal, and branch on POS-originated transactions. Present only when the transaction came through a POS channel.
• installmentPlan — installment plan details when the transaction was paid via an installment plan (e.g. valU, bank installments).
• card — present only when method is card. Carries the masked cardInfo (cardHolderName, cardBrand, maskedCard) and merchant.merchantRedirectURL. This is where masked card details arrive.
• sourceOfFunds — source-of-funds detail. Older published samples showed full card tokens here (cardHash, ccvToken, cardDataToken) alongside a 3DSecure.processACSRedirectURL block; the current payload builder emits neither, so don't build against them. Read masked card details from card.cardInfo instead.
• merchantDetails — merchant identification. The payload builder sets businessEmail; treat any other key as unconfirmed until you see it in a delivery of your own.
• apikeyname — the name of the API key the transaction was created with, useful when you run several keys across stores or environments.
• paymentMethod and channel — the method object and the channel the payment came through (e.g. online, e-commerce).
• originDetails — origin detail for the transaction.
• platform — the originating platform. Empty for direct API integrations, populated for platform-originated orders such as ecommerce plugins, so don't assume {}.
• signatureKeys — the keys of the data object that Kashier used to compute the HMAC signature for this request. Sort the array alphabetically, select those keys and their values from data, and build the signature payload from them. Verify the result against the x-kashier-signature header — see signature verification.
• hash — an internal Kashier integrity field (sent for non-Wix platforms), not a merchant-facing signature. It's signed with a server-side secret you don't hold, so do not attempt to verify it. Always verify webhooks using x-kashier-signature as described above; ignore data.hash if present.