Webhooks are a way for your apps to get notified of events. Such as when:a new transaction has been posted to your account
a pending transaction has been cancelled
your account balance has changed
a virtual account has been created
a virtual account has been suspended due to suspicious transaction
If you would like to opt-in for webhook events, you may do so by contacting your account manager. They will assist setting up your webhooks and provide you a secret for each of the webhooks.You may register for more than one webhooks. Each webhook may listen for a different set of events and post to a different destination.Webhook events will be notified to all matching webhooks by HTTP POST.Webhook payload#
Verifying webhook notifications#
Webhook notifications carry the following headers| Key | Value |
|---|
x-fomo-webhook-version | 1 |
x-fomo-webhook-signature | Signature in hexadecimal |
content-type | application/json |
The signature is calculated by applying HMAC-SHA256 to the webhook payload (HTTP body) using the secret for the webhook.If you have multiple webhooks configured, please make sure you are using the correct secret for each of the webhooks.
If the computed signature does not match the signature provided in the webhook header, the message must be rejected, as it may indicate payload tampering.Webhook delivery#
Notifications will be retried multiple times if FOMO did not get a successful acknowledgement from the webhook endpoint. The interval between each notification increases exponentially.You may acknowledge the webhook event by responding HTTP status 200 to the notification. By acknowledging the webhook event, the same webhook event will not be notified again. However, you must be able to handle cases where the same event is notified multiple times. You may identify if events in multiple notifications are the same by checking the event id. Each event carries an unique event id.