Webhooks

POST https://vas.finpaytech.co/business-api/api/v1/merchants/me/webhook-endpoints
Authorization: Bearer <access-token>
Content-Type: application/json

{
  "url": "https://partner.example.com/webhooks/emaal",
  "description": "Production collections"
}

GET https://vas.finpaytech.co/business-api/api/v1/merchants/me/webhook-endpoints
POST https://vas.finpaytech.co/business-api/api/v1/merchants/me/webhook-endpoints/{endpointId}/deactivate

{
  "id": "5e8b3c1a-2d44-4f0e-9c11-0a1b2c3d4e5f",
  "type": "payment.paid",
  "createdAt": "2026-09-09T07:52:21.200Z",
  "data": {
    "paymentId": "70d9370e-62ad-4b97-a024-862feee88541",
    "merchantId": "301f0991-8f7c-4501-a1d4-c317fe7b7f23",
    "subMerchantId": null,
    "expectedPaymentId": "721e86a8-fd29-49b5-b42f-67e19dfb2f6e",
    "paymentReference": "INV-2026-1044",
    "amount": 130.00,
    "currency": "KES",
    "virtualAccountId": "9d6be39e-9465-4d67-a05a-4b366352bd64",
    "attributionStatus": "ATTRIBUTED",
    "attributionMethod": "INVOICE_VA",
    "receiptId": null,
    "receiptNumber": null,
    "creditedAt": "2026-09-08T16:52:08.000Z"
  }
}

import hashlib
import hmac

def valid(secret: str, raw_body: bytes, header: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, header)