Responses And Notifications

Important

• Monri Webhook endpoints can only be set by a Monri support agent.
• For webhook(s) to be set please provide webhook from the table and matching endpoints at support@monri.com

Possible triggering events:

No.	Webhook	Triggers on
1.	transaction:refund:approved	approved refund transaction
2.	transaction:refund:declined	declined refund transaction
3.	transaction:void:approved	approved void
4.	transaction:void:declined	declined void
5.	transaction:capture:approved	approved capture
6.	transaction:capture:declined	declined capture
7.	transaction:purchase:approved	approved purchase
8.	transaction:purchase:declined	declined purchase
9.	transaction:authorize:approved	approved pre-authorization
10.	transaction:authorize:declined	declined pre-authorization
11.	transaction:approved	approved transaction (any)
12.	transaction:declined	declined transaction (any)
13.	payment-method:tokenized	when tokenized card

Webhook response structure:
Unlike callback Webhook's have two additional parameters (one more level):

1. event - information on what event it was triggered (see list above)
2. payload - matches callback payload

Example:

{
  "event": "transaction:approved",
  "payload": {
    "id": 996660,
    "acquirer": "xml-sim",
    "order_number": "0d4546c748b9c4f",
    "order_info": "Monri Test",
    "amount": 100,
    "currency": "EUR",
    ...
 }

Callback is back-off system that sends response to endpoint you define and can be set under your merchant profile, under option Callback URL. Callback is a HTTP POST request with all the transaction parameters for each approved transaction.

Other response options

For declined transactions and/or specific transaction steps please refer to WebHooks

Monri system expects HTTP 200 OK status response code to terminate the job, otherwise we’ll send the data periodically until we receive 200.

POST request is sent to your endpoint in JSON format and here is a list of parameters included in callback request:

{
   "id":186562,
   "acquirer":"integration_acq",
   "order_number":"a6b62d07cc89aa0",
   "order_info":"order info for a6b62d07cc89aa0",
   "amount":100,
   "currency":"EUR",
   "ch_full_name":"John Doe",
   "outgoing_amount":100,
   "outgoing_currency":"EUR",
   "approval_code":"914783",
   "response_code":"0000",
   "response_message":"approved",
   "reference_number":"000002902038",
   "systan":"186561",
   "eci":"05",
   "xid":"fake authenticated xid +=",
   "acsv":"fake authenticated cavv +=",
   "cc_type":"visa",
   "status":"approved",
   "created_at":"2019-09-06T14:24:44.906+02:00",
   "transaction_type":"purchase",
   "enrollment":"Y",
   "authentication":"Y",
   "pan_token":null,
   "masked_pan":"434179-xxx-xxx-0044",
   "issuer":"zaba-hr",
   "number_of_installments":null,
   "custom_params":"{a:b, c:d}"
}

Callback source check
To confirm that a callback request originates from Monri, inspect the POST request headers. The authorization and http_authorization headers contain a digest used for validation.

Sample Headers:

header	value
accept-encoding	gzip;q=1.0,deflate;q=0.6,identity;q=0.3
authorization	WP3-callback d5e4528ad8a0e0f4262e518c663d5ff83cd4a8f381db68f9d30f99961409ceebb719c16d423757fc36c532b902c987012f5825dc8d32dde3a9b7ed95876be77a
content-type	application/json
http_authorization	WP3-callback d5e4528ad8a0e0f4262e518c663d5ff83cd4a8f381db68f9d30f99961409ceebb719c16d423757fc36c532b902c987012f5825dc8d32dde3a9b7ed95876be77a
user-agent	Faraday v0.15.4
content-length	621
connection	keep-alive

The authorization and http_authorization headers are generated using the following logic:

• digest = sha512(merchant_key + body)
• authorization_header_value = WP3-callback digest

Validation Steps
To validate the callback request:

1. Check the Authorization Scheme
   Ensure the authorization header starts with WP3-callback.
2. Extract the Digest
   Retrieve the digest value that follows the scheme.
3. Verify the Digest
   Recalculate the digest using your merchant_key and the raw request body, then compare it to the one provided in the header.