POST
Provider webhooks/webhooks/{provider}Receive provider webhook
Provider-facing inbound webhook. Sign the exact payload with the provisioned provider secret and send timestamp plus stable event identifier.
Access tierprovider_onlyRate limitpay_apiIdempotencyprovider event idAuthenticationWebhookSignature + WebhookTimestamp
Source
LuxApi/Modules/PayWebhooks/Controllers/WebhookController.php::handleLuxPayProjects @ 146e98baa44eParameters
X-Request-IDheaderClient correlation identifier. LuxPay may generate one when omitted.
Example:req_01J...providerpathProvider code registered by LuxPay.
Example:walletX-SignatureheaderProvider signature.
X-TimestampheaderUnix timestamp used for replay protection.
X-Provider-Event-IdheaderStable event identifier for deduplication.
Request body
ProviderWebhookPayloadRequired
{
"type": "object",
"description": "Provider-specific event payload. LuxPay verifies the signature before queueing the event.",
"additionalProperties": true,
"example": {
"event_id": "evt_01JABC",
"type": "payment.completed",
"data": {
"id": "provider_tx_123",
"status": "completed"
}
}
}JSON example
{
"event_id": "evt_01JABC",
"type": "payment.completed",
"data": {
"id": "provider_tx_123",
"status": "completed"
}
}Code examples
The displayed sandbox host is a placeholder until an official host is provisioned. Never paste a production token into a public browser.
curl --request POST \
--url 'https://sandbox-api.luxpay.example/v1/webhooks/wallet' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--data '{
"event_id": "evt_01JABC",
"type": "payment.completed",
"data": {
"id": "provider_tx_123",
"status": "completed"
}
}'Responses
200Successful response.
statusstring
Allowed: accepted, rejected
duplicateboolean
{
"status": "accepted",
"duplicate": false
}400
401
403Signature or timestamp verification failed.
statusstring
Allowed: accepted, rejected
duplicateboolean
{
"status": "accepted",
"duplicate": false
}