> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rebellapp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Payment Notify Webhook

> Payment notification payload sent to your webhook endpoint.



## OpenAPI

````yaml POST /webhooks/paymentNotify
openapi: 3.0.3
info:
  title: Rebell Payments API
  version: 0.2.0-draft
  description: >

    OpenAPI derived from "Rebell API Specifications – (Draft for estimate
    integration)".

    This spec covers authentication headers (RSA SHA256 signature), payment
    creation, inquiry, retail pay,

    and webhook notification payloads.


    ---

    ## Swagger UI local setup (dynamic headers)

    This API requires `Request-Time` (RFC 3339) and an RSA-SHA256 `Signature`
    computed **at request time** over:


    ```text

    METHOD + "\n" + HTTP_URI + "\n" + Client-Id + "\n" + Request-Time + "\n" +
    BODY

    ```


    **Recommended pattern (no cloud):**

    - Serve this spec with Swagger UI locally.

    - Use a `requestInterceptor` to set `Client-Id`, compute fresh
    `Request-Time`, and call a **local signer** (running on localhost) to
    produce the base64 signature.

    - Inject the resulting header: `Signature: algorithm=SHA256withRSA,
    keyVersion={keyVersion}, signature={base64}`.


    See `x-swagger-ui-requestInterceptor` in this spec for a drop-in snippet and
    the minimal Node.js signer.



    ### Note on Swagger UI layouts

    If you see `No layout defined for "StandaloneLayout"`, either:

    - include `SwaggerUIStandalonePreset` in your HTML and set `layout:
    "StandaloneLayout"`, **or**

    - simply use `layout: "BaseLayout"` (this spec's embedded snippet uses
    BaseLayout for compatibility).
servers:
  - url: https://api.rebellapp.com
    description: Production
  - url: https://sandbox-api.rebellapp.com
    description: Sandbox (testing)
security:
  - RebellSignature: []
    ClientId: []
    RequestTime: []
tags:
  - name: Authentication
    description: Signature and headers
  - name: Payments
  - name: Webhooks
paths:
  /webhooks/paymentNotify:
    post:
      tags:
        - Webhooks
      summary: Payment notification (callback from Rebell to Merchant)
      description: >-
        Merchant-provided HTTPS endpoint that receives payment events. Events:
        `payment.succeeded`, `payment.failed`.
      operationId: paymentNotify
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PaymentNotification'
      responses:
        '200':
          description: Acknowledge receipt
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookAck'
      x-codeSamples:
        - lang: JavaScript
          label: Express.js Handler
          source: |-
            // Webhook endpoint to receive payment notifications
            app.post('/webhooks/rebell', express.json(), (req, res) => {
              // 1. Verify the signature (see Authentication docs)
              if (!verifySignature(req)) {
                return res.status(401).json({ result: { resultStatus: 'F' } });
              }

              const { paymentId, paymentRequestId, paymentStatus, paymentAmount } = req.body;

              // 2. Process the payment result
              if (paymentStatus === 'SUCCESS') {
                // Update order status, trigger fulfillment, etc.
                updateOrderStatus(paymentRequestId, 'paid');
              } else if (paymentStatus === 'FAIL') {
                updateOrderStatus(paymentRequestId, 'failed');
              }

              // 3. Acknowledge receipt
              res.json({ result: { resultStatus: 'S' } });
            });
        - lang: Python
          label: Flask Handler
          source: |-
            from flask import Flask, request, jsonify

            @app.route('/webhooks/rebell', methods=['POST'])
            def handle_payment_webhook():
                # 1. Verify the signature (see Authentication docs)
                if not verify_signature(request):
                    return jsonify({'result': {'resultStatus': 'F'}}), 401

                data = request.json
                payment_status = data['paymentStatus']
                payment_request_id = data['paymentRequestId']

                # 2. Process the payment result
                if payment_status == 'SUCCESS':
                    update_order_status(payment_request_id, 'paid')
                elif payment_status == 'FAIL':
                    update_order_status(payment_request_id, 'failed')

                # 3. Acknowledge receipt
                return jsonify({'result': {'resultStatus': 'S'}})
components:
  schemas:
    PaymentNotification:
      type: object
      properties:
        paymentId:
          type: string
        paymentRequestId:
          type: string
        paymentStatus:
          type: string
          enum:
            - SUCCESS
            - PROCESSING
            - FAIL
        paymentAmount:
          $ref: '#/components/schemas/Amount'
        paymentTime:
          type: string
          format: date-time
        paymentCreatedTime:
          type: string
          description: ISO 8601 creation time
      required:
        - paymentId
        - paymentRequestId
        - paymentStatus
        - paymentAmount
        - paymentTime
    WebhookAck:
      type: object
      properties:
        result:
          $ref: '#/components/schemas/Result'
      required:
        - result
    Amount:
      type: object
      properties:
        currency:
          type: string
        value:
          type: integer
      required:
        - currency
        - value
      description: Amount in minor units (e.g., cents).
    Result:
      type: object
      properties:
        resultStatus:
          type: string
          enum:
            - S
            - F
            - U
            - A
        resultCode:
          type: string
        resultMessage:
          type: string
      required:
        - resultStatus
  securitySchemes:
    RebellSignature:
      type: apiKey
      in: header
      name: Signature
      description: >-
        RSA SHA256 signature header. Example: `Signature:
        algorithm=SHA256withRSA, keyVersion=0, signature=BASE64...`
    ClientId:
      type: apiKey
      in: header
      name: Client-Id
      description: Rebell-assigned Client Id.
    RequestTime:
      type: apiKey
      in: header
      name: Request-Time
      description: RFC3339 timestamp (e.g., 2019-05-28T12:12:00+08:00).

````