Virtual Account Webhook

Money In Operation — This webhook fires when a customer completes a Virtual Account payment, transferring funds into your SingaPay account.

Information

Method	Path	Format	Authentication
POST	`https://your-webhook-url/callback`	json	HMAC SHA512 Signature

SingaPay sends a POST request to your configured transaction_notif_url when a Virtual Account transaction is successfully processed.

This webhook may share a callback URL with other event types. See Shared webhook endpoints for routing by event value.

Request Details

Headers

Field	Value	Type	Mandatory	Description
`Content-Type`	`application/json`	Alphabetic	Yes	Specifies JSON format for the request body
`User-Agent`	`SingaPaymentGateway/1.0`	Alphabetic	Yes	Identifies the source of the webhook
`Accept`	`application/json`	Alphabetic	Yes	Expected response format
`X-PARTNER-ID`	—	Alphanumeric	Yes	Your API Key from the merchant dashboard
`X-Signature`	—	Alphanumeric	Yes	HMAC SHA512 signature (128 chars) for request verification
`X-Timestamp`	—	Numeric	Yes	Unix timestamp in seconds when the request was sent
`Authorization`	`Bearer <random_token>`	Alphanumeric	Yes	System-generated random bearer token; used as a component in the signature

The Authorization token for VA webhooks is a randomly generated string — not a user access token. This is because the webhook is triggered by a bank payment notification (system event), not a user action. Extract it as-is from the header and use it in the string to sign. See How to Validate Signature below.

Body Parameters

number

required

HTTP Status Code. Example: 200

boolean

required

Indicates if the transaction was successful. Example: true

string

required

Event type identifier. Always "va-transaction" for this webhook.

string

required

Event timestamp in format "d M Y H:i:s". Example: "26 Dec 2025 13:35:45"

object

required

Container for transaction and payment details.

Show data fields

object

required

Transaction details.

Show transaction fields

string

required

Merchant reference number if provided during VA creation (merchant_reff_no), otherwise falls back to transaction_id. Example: "INV-2026-001"

string

required

Internal system transaction ID. Example: "3211120250926133543246"

string

required

Transaction type. Always "va" for Virtual Account.

string

required

Transaction status. Always "paid" for this webhook.

object

required

Transaction amount details.

Show amount fields

number

required

Transaction amount. Example: 100000

string

required

ISO 4217 currency code. Example: "IDR"

string

required

VA amount type: "closed" (fixed amount) or "open" (any amount).

null

required

Tip amount. Always null for VA transactions.

string

required

Transaction post time. Example: "26 Dec 2025 13:35:43"

string

required

Transaction processed time. Example: "26 Dec 2025 13:35:45"

object

required

Payment method details.

Show payment fields

string

required

Payment method. Always "va".

object

required

Payment method specific information.

Show additional_info fields

string

required

Virtual Account number used for payment (16 digits). Example: "7872955146576837"

string

required

Virtual Account name/label. Example: "Toko Budi"

object

required

Bank details.

Show bank fields

string

required

Short name of the bank. Example: "Maybank"

string

required

Bank number/code (3 digits). Example: "016"

string

required

Bank SWIFT code (8 chars). Example: "IBBKIDJA"

string

required

Internal bank code. Example: "MAYBANK"

object

required

Transaction fee details.

Show fees fields

string

required

Payment vendor fee name. Example: "VA Maybank"

number

required

Fee amount charged. Example: 1500

string

required

Fee currency code. Example: "IDR"

Payload Example

Success

{
  "status": 200,
  "success": true,
  "event": "va-transaction",
  "timestamp": "26 Dec 2025 13:35:45",
  "data": {
    "transaction": {
      "reff_no": "INV-2026-001",
      "transaction_id": "3211120250926133543246",
      "type": "va",
      "status": "paid",
      "amount": {
        "value": 100000,
        "currency": "IDR"
      },
      "amount_type": "closed",
      "tip": null,
      "post_timestamp": "26 Dec 2025 13:35:43",
      "processed_timestamp": "26 Dec 2025 13:35:45"
    },
    "payment": {
      "method": "va",
      "additional_info": {
        "va_number": "7872955146576837",
        "va_name": "Toko Budi",
        "bank": {
          "short_name": "Maybank",
          "number": "016",
          "swift_code": "IBBKIDJA",
          "bank_code": "MAYBANK"
        },
        "fees": {
          "name": "VA Maybank",
          "amount": 1500,
          "currency": "IDR"
        }
      }
    }
  }
}

Security and responses

Return HTTP 200 promptly after validating the request. For retry behavior, see Webhook retry mechanism. Verify every webhook using Security and signature validation. Use your configured callback path when building StringToSign. Handle duplicate deliveries idempotently using stable identifiers from the payload (for example transaction_id or reff_no).

Getting Started

Security

Accept Money

Send Money

Transaction Records

Money Accounts

Webhook

Information

Request Details

Headers

Body Parameters

Payload Example

Security and responses

​Information

​Request Details

​Headers

​Body Parameters

​Payload Example

​Security and responses

Information

Request Details

Headers

Body Parameters

Payload Example

Security and responses