Receive callbacks notifying events in your accountWebhooks are callbacks that notify events in your account. A webhook will make an HTTP request to your application (usually by the POST method), whose body will contain an object describing the associated event. They are incredibly useful and a simple way to implement reactions to events.For example: When a recurring charge of a subscription is generated, a Webhook allows you to receive a notification so that you can take an action, such as sending a thank-you email to the user.Webhooks are also useful in two situations:
When a generated event is not a direct result of a call to the API. For example, the payment for a subscription.
When services or features need the response to a call, but they do not perform it directly. For example, an accounting service that needs to update accounting records when a transaction is generated.
These are some cases where Webhooks are used:
When updating a customer's membership in your database after the successful payment of a subscription.
When sending an email to a customer after the payment of his/her subscription fails.
When recording an accounting entry after a transaction is made.
The first step to consume a Webhook is creating an endpoint to receive them. This is not different from creating any other page on your website. Simply create a new path with the desired URL.Webhook data are sent in JSON format in the body of the POST call. All the event details are included and can be used directly (after parsing the JSON).
Fill out the request form: in this, you must submit the details of your merchant ID, webhook URL and the notifications you wish to receive. This way you will receive notifications of your transactions.
2.
Via API: to send and receive webhook notifications via API you must add the webhook object for the following endpoints:
In case you have a Webhook created by console and you decide to send the webhook request via API, both webhooks will be notified. This means that they will not be mutually exclusive.The notifications will be seen in the Webhooks Notifications dashboard and will have a new field called Configuration that will differentiate the source of the notification.
You may use an HTTP or an HTTPS URL for webhooks. In most cases, an HTTP is enough, but HTTPS may be useful if you're dealing with sensitive data or if you want to protect your system against replay attacks, for example.
In principle, anyone could send a request to your endpoint, so it's important to check that these webhooks are originated by Kushki. Therefore, to verify their authenticity, valid Webhooks will contain the following headings:
X-Kushki-Key: Merchant ID.
X-Kushki-Signature: It is the HMAC SHA256 signature of the body of the request, plus the timestamp, using your Webhook signature ID.
X-Kushki-SimpleSignature: Corresponds to the HMAC SHA256 signature of the X-Kushki-Id, using your webhook signature ID.
X-Kushki-Id: Date in timestamp format (UNIX Time).
What is the IP used to send notifications from Kushki?
Notifications are sent from the following static IP of Kushki, you can also check this as an additional validation.
UAT: 54.208.105.247
Production: 34.230.185.20
You should use these headings to compare the signature generated from your side by using your Merchant's Webhooks signature ID, that you can find in the console. You can use both X-Kushki-Signature and X-Kushki-SimpleSignature for the check.
You can view and copy the webhook signature from the Console. To do this, go to Desarrolladores > Webhooks. At the top you can easily copy the webhook signature.
If Notify Now fails, you must wait 20 minutes for the first retry to be sent and the same period of time to complete the hour, as shown below:
First retry: it is sent after 20 minutes.
Second retry: it is sent after 40 minutes.
Third retry: it is sent after 60 minutes (1 hour).
After 60 minutes (1 hour) and if the third retry fails, you must wait 30 minutes for the fourth retry to be sent until the next 2 hours are completed as described below:
Fourth retry: it is sent after 30 minutes.
Fifth retry: it is sent after 60 minutes.
Sixth retry: it is sent after 90 minutes.
Seventh retry: it is sent after 120 minutes.
Note
Keep in mind that these times are estimates and may be subject to variations.
