Sign in

v1

latestOpenAPI 3.0.32026-07-23167675.4 KB
Merchant Notification

Binding Result Notification to Merchant

posthttps://{api-domain}/v1.0/debit/notify

Headers

X-PARTNER-IDstring required

The merchant's client ID registered with DOKU

X-EXTERNAL-IDstring required

A unique ID generated by DOKU for each notification. The merchant can use this value for idempotency checks.

X-TIMESTAMPstring required

Notification send timestamp in ISO 8601 format (yyyy-MM-ddTHH:mm:ss+07:00)

X-SIGNATUREstring required

HMAC-SHA512 digital signature for verifying the authenticity of the notification. The merchant MUST verify this signature before processing the notification.

Verification steps:

  1. Construct stringToSign: HTTP-METHOD:RELATIVE-URL:ACCESS-TOKEN:HEX(SHA256(requestBody)):TIMESTAMP
  2. Compute HMAC-SHA512 using the merchant's clientSecret as the key.
  3. Compare against the value of this header.
Authorization-Customerstring

Customer's B2B2C access token (DOKU B2B2C token) associated with this binding session. Present when the customer holds an active DOKU B2B2C token.

Request body

originalExternalIdstring required

The X-EXTERNAL-ID value from the original binding request submitted by the merchant. Used by the merchant to correlate this notification with the original binding request.

Response

Notification successfully received and processed by the merchant.

responseCodestring

SNAP-format response code. Example: 2000700 = HTTP 200 + service 07 + case 00 (Successful).

responseMessagestring

Human-readable response message