Mozarto sends the final status of every Hosted page API payment to your webhook URL. The payload, signature, and retries are the same as for the Redirect API, so one endpoint handles both. Use the webhook, not browser events or return URLs, to credit an account or fulfil an order.When Mozarto sends it#
Mozarto sends one webhook each time a payment reaches a final status:transaction_status | Sent when |
|---|
Approved | The provider approved the payment |
Declined | The provider or the issuer declined the payment, including a failed 3D Secure authentication |
Failed | The provider returned a technical error |
No webhook is sent while a payment is pending or in 3D Secure. A resent provider notification with the same status does not trigger a second webhook. If a provider later changes the status, Mozarto sends a new webhook with the new status.Where Mozarto sends it#
Mozarto sends the webhook to the Webhook URL, and any additional webhook URLs, configured on the provider account that processed the payment (Payments Module - Processing Scope tab - API Credentials). The URLs are not set in the session request.Payload#
{
"transaction_id": "6adf517cc7d44034bd18d020",
"psp_transaction_id": "a80f9ea4af542913ec5930837e54bee8",
"user_id": "user_123",
"status": "SUCCESS",
"transaction_status": "Approved",
"message": "Transaction approved and successfully processed",
"amount": "14",
"currency": "EUR",
"merchantReference": "ORDER-4821"
}
| Field | Type | Description |
|---|
transaction_id | string | Mozarto transaction ID. Matches transactionId in the MOZARTO_HPP_FINAL_STATUS browser event |
psp_transaction_id | string | The provider's reference for the payment |
user_id | string | userId from the user token used to create the session |
status | string | Internal status. Do not use it for business logic |
transaction_status | string | Normalized status: Approved, Declined, or Failed. Use this for business logic |
message | string | Human-readable outcome. For a decline, the provider's reason when available |
amount | string | Session baseamount |
currency | string | Session currency |
merchantReference | string | merchantReference from the session request. Empty string if not sent |
Verify, acknowledge, and de-duplicate#
Verify the Authorization header before changing any balance or order.
Respond with a 2xx status within 5 seconds. Failed deliveries are retried for about 10.5 hours.
Use the X-Webhook-Id header to ignore duplicates. A retry carries the same ID.
Example flow#
Modified at 2026-11-03 08:10:23
