Virtual Account Webhook - Singapay Documentation

Money In Operation — This webhook fires when a customer completes a Virtual Account payment, transferring funds into your SingaPay account.

Information

Method	Path	Format	Authentication
POST	`https://your-webhook-url/callback`	json	HMAC SHA512 Signature

SingaPay sends a POST request to your configured transaction_notif_url when a Virtual Account transaction is successfully processed.

This webhook may share a callback URL with other event types. See Shared webhook endpoints for routing by event value.

Request Details

Headers

Field	Value	Type	Mandatory	Description
`Content-Type`	`application/json`	Alphabetic	Yes	Specifies JSON format for the request body
`User-Agent`	`SingaPaymentGateway/1.0`	Alphabetic	Yes	Identifies the source of the webhook
`Accept`	`application/json`	Alphabetic	Yes	Expected response format
`X-PARTNER-ID`	—	Alphanumeric	Yes	Your API Key from the merchant dashboard
`X-Signature`	—	Alphanumeric	Yes	HMAC SHA512 signature (128 chars) for request verification
`X-Timestamp`	—	Numeric	Yes	Unix timestamp in seconds when the request was sent
`Authorization`	`Bearer <random_token>`	Alphanumeric	Yes	System-generated random bearer token; used as a component in the signature

The Authorization token for VA webhooks is a randomly generated string — not a user access token. This is because the webhook is triggered by a bank payment notification (system event), not a user action. Extract it as-is from the header and use it in the string to sign. See How to Validate Signature below.

Body Parameters

status

number

required

HTTP Status Code. Example: 200

success

boolean

required

Indicates if the transaction was successful. Example: true

event

string

required

Event type identifier. Always "va-transaction" for this webhook.

timestamp

string

required

Event timestamp in format "d M Y H:i:s". Example: "26 Dec 2025 13:35:45"

data

object

required

Container for transaction and payment details.

Show data fields

transaction

object

required

Transaction details.

Show transaction fields

reff_no

string

required

Merchant reference number if provided during VA creation (merchant_reff_no), otherwise falls back to transaction_id. Example: "INV-2026-001"

transaction_id

string

required

Internal system transaction ID. Example: "3211120250926133543246"

type

string

required

Transaction type. Always "va" for Virtual Account.

status

string

required

Transaction status. Always "paid" for this webhook.

amount

object

required

Transaction amount details.

Show amount fields

value

number

required

Transaction amount. Example: 100000

currency

string

required

ISO 4217 currency code. Example: "IDR"

amount_type

string

required

VA amount type: "closed" (fixed amount) or "open" (any amount).

tip

null

required

Tip amount. Always null for VA transactions.

post_timestamp

string

required

Transaction post time. Example: "26 Dec 2025 13:35:43"

processed_timestamp

string

required

Transaction processed time. Example: "26 Dec 2025 13:35:45"

payment

object

required

Payment method details.

Show payment fields

method

string

required

Payment method. Always "va".

additional_info

object

required

Payment method specific information.

Show additional_info fields

va_number

string

required

Virtual Account number used for payment (16 digits). Example: "7872955146576837"

va_name

string

required

Virtual Account name/label. Example: "Toko Budi"

bank

object

required

Bank details.

Show bank fields

short_name

string

required

Short name of the bank. Example: "Maybank"

number

string

required

Bank number/code (3 digits). Example: "016"

swift_code

string

required

Bank SWIFT code (8 chars). Example: "IBBKIDJA"

bank_code

string

required

Internal bank code. Example: "MAYBANK"

fees

object

required

Transaction fee details.

Show fees fields

name

string

required

Payment vendor fee name. Example: "VA Maybank"

amount

number

required

Fee amount charged. Example: 1500

currency

string

required

Fee currency code. Example: "IDR"

Payload Example

Success

{
  "status": 200,
  "success": true,
  "event": "va-transaction",
  "timestamp": "26 Dec 2025 13:35:45",
  "data": {
    "transaction": {
      "reff_no": "INV-2026-001",
      "transaction_id": "3211120250926133543246",
      "type": "va",
      "status": "paid",
      "amount": {
        "value": 100000,
        "currency": "IDR"
      },
      "amount_type": "closed",
      "tip": null,
      "post_timestamp": "26 Dec 2025 13:35:43",
      "processed_timestamp": "26 Dec 2025 13:35:45"
    },
    "payment": {
      "method": "va",
      "additional_info": {
        "va_number": "7872955146576837",
        "va_name": "Toko Budi",
        "bank": {
          "short_name": "Maybank",
          "number": "016",
          "swift_code": "IBBKIDJA",
          "bank_code": "MAYBANK"
        },
        "fees": {
          "name": "VA Maybank",
          "amount": 1500,
          "currency": "IDR"
        }
      }
    }
  }
}

Security and responses

Return HTTP 200 promptly after validating the request. For retry behavior, see Webhook retry mechanism. Verify every webhook using Security and signature validation. Use your configured callback path when building StringToSign. Handle duplicate deliveries idempotently using stable identifiers from the payload (for example transaction_id or reff_no).

​Information

​Request Details

​Headers

​Body Parameters

​Payload Example

​Security and responses

Information

Request Details

Headers

Body Parameters

Payload Example

Security and responses