QRIS Acquirer Webhook - Singapay Documentation

Money In Operation — This webhook fires when a customer completes a QRIS payment, transferring funds into your SingaPay account.

Information

Method	Path	Format	Authentication
POST	`https://your-webhook-url/callback`	json	HMAC SHA512 Signature

SingaPay sends a POST request to your configured transaction_notif_url when a QRIS transaction is successfully processed.

This webhook may share a callback URL with other event types. See Shared webhook endpoints for routing by event value.

Request Details

Headers

Field	Value	Type	Mandatory	Description
`Content-Type`	`application/json`	Alphabetic	Yes	Specifies JSON format for the request body
`User-Agent`	`SingaPaymentGateway/1.0`	Alphabetic	Yes	Identifies the source of the webhook
`Accept`	`application/json`	Alphabetic	Yes	Expected response format
`X-PARTNER-ID`	—	Alphanumeric	Yes	Your API Key from the merchant dashboard
`X-Signature`	—	Alphanumeric	Yes	HMAC SHA512 signature (128 chars) for request verification
`X-Timestamp`	—	Numeric	Yes	Unix timestamp in seconds when the request was sent
`Authorization`	`Bearer <random_token>`	Alphanumeric	Yes	System-generated random bearer token; used as a component in the signature

The Authorization token for QRIS webhooks is a randomly generated string — not a user access token. This webhook is triggered by a bank payment notification (system event), not a user action. Extract the token as-is from the header and use it in the string to sign. See How to Validate Signature below.

Body Parameters

status

number

required

HTTP Status Code. Example: 200

success

boolean

required

Indicates if the transaction was successful. Example: true

event

string

required

Event type identifier. Always "qris-acquirer-transaction" for this webhook.

timestamp

string

required

Event timestamp in format "d M Y H:i:s". Example: "26 Dec 2025 13:31:59"

data

object

required

Container for transaction, customer, and payment details.

Show data fields

transaction

object

required

Transaction details.

Show transaction fields

integer

required

Unique transaction ID. Example: 42

reff_no

string

required

Unique transaction reference number (28 chars). Example: "6601K62BH34X445J046C4W5249E6"

merchant_reff_no

string

Optional merchant reference number for tracing. Example: "INV-2026-001"

type

string

required

Transaction type. Always "qris" for QRIS transactions.

status

string

required

Transaction status. Always "paid" for this webhook.

amount

object

required

Base transaction amount before tip.

Show amount fields

value

number

required

Base transaction amount. Example: 1000123

currency

string

required

ISO 4217 currency code. Example: "IDR"

tip

object

required

Tip amount details.

Show tip fields

value

number

required

Tip amount. 0 if no tip. Example: 0

currency

string

required

ISO 4217 currency code. Example: "IDR"

total_amount

object

required

Total amount including tip (amount + tip).

Show total_amount fields

value

number

required

Total transaction amount. Example: 1000123

currency

string

required

ISO 4217 currency code. Example: "IDR"

post_timestamp

string

required

Transaction post time. Example: "26 Dec 2025 13:31:59"

processed_timestamp

string

required

Transaction processed time. Example: "26 Dec 2025 13:31:59"

customer

object

required

Customer details.

Show customer fields

string

required

Customer unique ID (26 chars). Example: "01K2KVRQQP45234X9T3YWG1FKT"

name

string

required

Customer full name. Example: "Moh. Zulkifli Katili"

string

required

Customer email address. Example: "tes@gmail.com"

phone

string

required

Customer phone number. Example: "08123993201"

payment

object

required

Payment method details.

Show payment fields

method

string

required

Payment method. Always "qris".

additional_info

object

required

QRIS-specific payment information.

Show additional_info fields

qr_string

string

required

Raw QRIS string data used for payment. Example: "00020101021226570015ID.SINGAPAY.WWW..."

payment_event_id

number

required

Internal payment event ID for tracking. Example: 12345

Payload Example

Success

{
  "status": 200,
  "success": true,
  "event": "qris-acquirer-transaction",
  "timestamp": "26 Dec 2025 13:31:59",
  "data": {
    "transaction": {
      "id": 42,
      "reff_no": "6601K62BH34X445J046C4W5249E6",
      "merchant_reff_no": "INV-2026-001",
      "type": "qris",
      "status": "paid",
      "amount": {
        "value": 1000123,
        "currency": "IDR"
      },
      "tip": {
        "value": 0,
        "currency": "IDR"
      },
      "total_amount": {
        "value": 1000123,
        "currency": "IDR"
      },
      "post_timestamp": "26 Dec 2025 13:31:59",
      "processed_timestamp": "26 Dec 2025 13:31:59"
    },
    "customer": {
      "id": "01K2KVRQQP45234X9T3YWG1FKT",
      "name": "Moh. Zulkifli Katili",
      "email": "tes@gmail.com",
      "phone": "08123993201"
    },
    "payment": {
      "method": "qris",
      "additional_info": {
        "qr_string": "00020101021226570015ID.SINGAPAY.WWW01110508140001102122183098102390303UMI51440014ID.CO.QRIS.WWW02157434441747371980303UMI520472315303360540710001235802ID5916PT TARSIUS TAHIR6009Tangerang6105544786253051017588683110703C0108286601K62BH34X445J046C4W5249E663045FC6",
        "payment_event_id": 12345
      }
    }
  }
}

Security and responses

Return HTTP 200 promptly after validating the request. For retry behavior, see Webhook retry mechanism. Verify every webhook using Security and signature validation. Use your configured callback path when building StringToSign. Handle duplicate deliveries idempotently using stable identifiers from the payload (for example transaction_id or reff_no).

​Information

​Request Details

​Headers

​Body Parameters

​Payload Example

​Security and responses

Information

Request Details

Headers

Body Parameters

Payload Example

Security and responses