Webhooks
Know when a payment or refund finishes. Even if your server was down.
ZopPay tells your server the outcome of every payment and refund with a signed message, the same on every gateway. If your server doesn’t answer, ZopPay tries again, six times in all.
Retries
When your server is down. ZopPay tries again.
Pick a scenario to see the schedule. Any 2xx reply within 10 seconds counts as delivered.
Delivery to https://kaverihome.in/hooks/zoppay
Delivered on attempt 3
| Attempt | When | Since the event | Your server said |
|---|---|---|---|
| 1 | At once | 0 s | 500 |
| 2 | 1 min later | 1 min | Timed out |
| 3 | 5 min later | 6 min | 200 OK |
| 4 | 30 min later | 36 min | Not needed |
| 5 | 2 h later | 2 h 36 min | Not needed |
| 6 | 12 h later | 14 h 36 min | Not needed |
Any 2xx reply within 10 seconds counts as delivered, and the retries stop.
Events
Four events. One shape for all of them.
Every event looks the same whichever gateway took the payment. Add your endpoints on the Webhooks page of your dashboard.
- payment.captured
- The customer paid and the gateway confirmed it.
- payment.failed
- The payment didn’t go through: the gateway said it failed or was cancelled, or the checkout link expired. If the gateway later shows it was paid, payment.captured follows.
- refund.succeeded
- The gateway completed the refund.
- refund.failed
- The gateway refused the refund.
X-PP-Signature-V2: sha256=<hex> X-PP-Signature: sha256=<hex> X-PP-Timestamp: 2025-11-15T10:21:03Z X-PP-Event: payment.captured X-PP-Delivery-ID: whd_01JCP…
{ "id": "whe_01JCP…", "type": "payment.captured", "created_at": "2025-11-15T10:21:03Z", "organisation_id": "org_01J…", "data": { "payment_id": "pay_01JCP…", "order_id": "ord_01JCP…", "amount": 19900, "currency": "INR", "gateway_transaction_id": "pay_XXXXXXXX" } }
Details
Built for the day something goes wrong.
Signed and timestamped
X-PP-Signature-V2 is an HMAC-SHA256 of the timestamp and the raw body, using your endpoint’s secret. Check it, and reject old timestamps, so nobody can fake or replay a delivery.
Retried six times
At once, then after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours: about 14½ hours in all. Each attempt waits up to 10 seconds for your reply.
Safe to receive twice
Every event has its own id. Store it, and a retry that arrives after all can’t ship an order twice.
Recent deliveries in your dashboard
The Webhooks page lists your 50 most recent deliveries, with the number of attempts, the last reply from your server and when it was sent.
Public HTTPS addresses only
Endpoints must use https and a public address. Private and internal addresses are refused, and redirects are not followed.
Up to 10 endpoints
Each endpoint has its own signing secret, stored encrypted. You can reveal it again on the Webhooks page.
Good to know
What webhooks don’t do.
- There is no button to send a delivery again. After the sixth failed attempt, look the payment or refund up with the API instead.
- Delivery bodies are deleted after 30 days.
- Webhooks tell you about payments and refunds only. Gateway changes and settings changes don’t send events.
Start with test mode today.
Sign up free, make a test payment from your dashboard and see how it works. Connect your gateway when you're ready.