Vendor notifications

Administrators configure an HTTPS webhook URL and a secret of at least 32 characters on the vendor. Destinations must resolve to public IPv4 addresses. Private/reserved destinations and redirects are rejected. DNS is pinned for the request to prevent rebinding. IPv6-only endpoints are not supported in this release.

Every notification is a durable outbox record. Retries reuse the event ID and payload sequence, and do not call any purchase endpoint. Delivery has exponential backoff capped at one hour. Failed delivery does not change the purchase result.

Headers:

text

X-Fluxr-Event-Id: 123
X-Fluxr-Timestamp: 1790000000
X-Fluxr-Signature: sha256=<hex digest>
Content-Type: application/json

Compute HMAC-SHA256 using the configured secret over timestamp + "." + raw_body. Verify it with a constant-time comparison and reject timestamps outside your replay window. Persist event IDs before applying side effects. A retry uses a fresh signature timestamp but the same event ID.

json

{
  "event_id":"123",
  "sequence":123,
  "type":"provider_completed",
  "transaction_id":"019…",
  "reference":"platform-order-123",
  "status":"completed",
  "occurred_at":"2026-09-20T10:00:00+00:00"
}

Sequence numbers are monotonically increasing gateway event IDs. Delivery can arrive out of order; track the latest sequence per transaction and retrieve authoritative current status when needed. Return any 2xx status after durable handling. Notifications contain no PINs, activation codes, wholesale breakdowns or recipient identifiers.

Vendor notifications ​

Vendor notifications