Webhook Guide
Receive real-time event notifications from the M2P Platform via HTTP callbacks.
Webhooks deliver real-time event notifications from the M2P Platform to your system via HTTP POST callbacks. Instead of polling for updates, you receive instant notifications when events occur.
How Webhooks Work
Requirements
| Requirement | Details |
|---|---|
| Protocol | HTTPS only (TLS 1.2+) |
| Method | Your endpoint must accept POST requests |
| Response | Return HTTP 200 within 10 seconds |
| Content Type | Payloads are sent as application/json |
| Availability | 99.9% uptime recommended |
| Idempotency | Your handler must be idempotent — the same event may be delivered multiple times |
Webhook URLs and secrets are configured per tenant during onboarding. Contact your M2P account manager to add or update webhook endpoints.
Sections
Webhook Events
Complete catalog of event types — transactions, cards, customers, e-collect, and tokens.
Payload Reference
Detailed payload structures for every event type with field descriptions.
Signature Verification
HMAC-SHA256 signature verification implementation in Node.js and Java.
Retry & Best Practices
Retry policy, failure handling, and production best practices.
Update, suspend, resume, or delete a digital wallet token POST
Update the status or information related to a digital wallet token. This API supports multiple operations through different parameter combinations based on the updateSource field. Supported networks are VISA (Visa Token Service), RUPAY (RuPay NPCI Token Service), and MASTERCARD (MasterCard Digital Enablement Service). Important - This endpoint does NOT use the /Yappay/ prefix. The full path is /itsp/issuer/updateToken. Update by TOKEN (suspend, resume, or delete a specific token) - Set updateSource to TOKEN. Provide tokenReferenceId and tokenRequesterId. Use tokenUpdateType SUSPEND to temporarily disable, RESUME to re-enable, DELETE to permanently remove, or REPLACED to mark as replaced. Use operationType UPDATE for suspend/resume/replaced, DELETE for delete. Update by KIT (update all tokens for a card) - Set updateSource to KIT. Provide kitNo and kitUpdateType. Use kitUpdateType RENEWAL for expiry date updates (requires oldExpiryDate and newExpiryDate). Other kitUpdateType values include ALLOCATED, BLOCKED, and LOCKED. Update by DPAN (update a digital PAN) - Set updateSource to DPAN. Provide the token (DPAN value) and tokenUpdateType. SUSPEND is reversible, DELETE is permanent. Always provide a meaningful reason for audit trail purposes.
Webhook Events
Complete catalog of webhook event types — transactions, cards, customers, e-collect, and token lifecycle.