Orders

Order creation is an important step as it helps you associate every payment with an order, thus preventing multiple payments. Orders and payments go hand-in-hand. Once a payment is captured, the order is marked paid. This is reflected in the order.paid and payment.captured webhook events as well. These events are triggered when the payment associated with the order is captured.

Comparison - order.paid Vs. payment.captured

The table below lists the Webhook events available for orders.

Order Paid

{
  "entity": "event",
  "account_id": "acc_BFQ7uQEaa7j2z7",
  "event": "order.paid",
  "contains": [
    "payment",
    "order"
  ],
  "payload": {
    "payment": {
      "entity": {
        "id": "pay_DESlfW9H8K9uqM",
        "entity": "payment",
        "amount": 100,
        "currency": "MYR",
        "status": "captured",
        "order_id": "order_DESlLckIVRkHWj",
        "invoice_id": null,
        "international": false,
        "method": "fpx",
        "amount_refunded": 0,
        "refund_status": null,
        "captured": true,
        "description": null,
        "card_id": null,
        "bank": "PHBM",
        "wallet": null,
        "email": "gaurav.kumar@example.com",
        "contact": "+919876543210",
        "notes": [],
        "fee": 2,
        "tax": 0,
        "error_code": null,
        "error_description": null,
        "created_at": 1567674599
      }
    },
    "order": {
      "entity": {
        "id": "order_DESlLckIVRkHWj",
        "entity": "order",
        "amount": 100,
        "amount_paid": 100,
        "amount_due": 0,
        "currency": "MYR",
        "receipt": "rcptid #1",
        "status": "paid",
        "attempts": 1,
        "notes": [],
        "created_at": 1567674581
      }
    }
  },
  "created_at": 1567674606
}

Watch Out!

If you have changed your webhook secret, remember to use the old secret for webhook signature validation while retrying older requests. Using the new secret will lead to a signature mismatch.

Do Not Parse or Cast the Webhook Request Body

While generating a signature at your end, ensure that the webhook body is passed as an argument in the raw webhook request body. Do not parse or cast the webhook request body.