Webhooks

Webhooks are event-based notifications that are received when a specific event related to the KYC verification occurs.

Add Webhooks

Add your webhook URL in our system for us to deliver webhook events.

Follow the instructions below to configure the webhook URL. Ensure to provide the publicly accessible HTTPS URL to your webhook endpoint.

Once you login to the dashboard with the credentials, click Developers.
Click Webhooks listed under the Verification Suite card.
Click Add Webhook URL in the Developers - Verification Suite screen.
In the Add Webhook popup, fill in the following information:
- Webhook URL - Enter the URL in this field.
Click Test & Add Webhook.

Webhook events

Event	Description
KYC_LINK_ACTION_PERFORMED	You will receive this event when one of the verifications is performed using the link.
KYC_LINK_SUCCESS	You will receive this event when all the verifications are performed successfully.
KYC_LINK_EXPIRED	You will receive this event when the link expires.

{
  "signature": "3YdAGMqBPDgWqy4zteRad/MoCmH59cm+93sogQWhOa8=",
  "event_type": "KYC_LINK_ACTION_PERFORMED",
  "event_time": "2024-02-15 16:53:15",
  "version": "v1",
  "data": {
  	"name": "Test",
"phone": "9999999999",
"email": "[email protected]",
  	"verification_id": "testverificationid",
  	"reference_id": 235461,
  	"link_expiry": "2025-12-02",
  	"form_link": "https://forms.cashfree.com/",
  	"form_status": "RECEIVED",
"verification_details": [
    	{
      		      "reference_id": 234,
      "type": "OFFLINE_AADHAAR_VERIFICATION",
      "status": "SUCCESS"
    		},
    		{
    		      "reference_id": 0,
      "type": "PANDETAILS_VERIFICATION",
      "status": "RECEIVED"
},
    		{
      "reference_id": 0,
      "type": "BANKDETAILS_VALIDATION",
      "status": "RECEIVED"
    		},
    		{
      "reference_id": 0,
      "type": "UPIDETAILS_VALIDATION",
      "status": "RECEIVED"
    		}
  	]
     }
}

{
  "signature": "3YdAGMqBPDgWqy4zteRad/MoCmH59cm+93sogQWhOa8=",
  "event_type": "KYC_LINK_SUCCESS",
  "event_time": "2024-02-15 16:53:15",
  "version": "v1",
  "data": {
  	"name": "Test",
"phone": "9999999999",
"email": "[email protected]",
  	"verification_id": "testverificationid",
  	"reference_id": 235461,
  	"link_expiry": "2025-12-02",
  	"form_link": "https://forms.cashfree.com/",
  	"form_status": "SUCCESS",
"verification_details": [
    	{
      		      "reference_id": 234,
      "type": "OFFLINE_AADHAAR_VERIFICATION",
      "status": "SUCCESS"
    		},
    		{
    		      "reference_id": 235,
      "type": "PANDETAILS_VERIFICATION",
      "status": "SUCCESS"
},
    		{
      "reference_id": 236,
      "type": "BANKDETAILS_VALIDATION",
      "status": "SUCCESS"
    		},
    		{
      "reference_id": 237,
      "type": "UPIDETAILS_VALIDATION",
      "status": "SUCCESS"
    		}
  	]
     }
}

{
  "signature": "3YdAGMqBPDgWqy4zteRad/MoCmH59cm+93sogQWhOa8=",
  "event_type": "KYC_LINK_EXPIRED",
  "event_time": "2024-02-15 16:53:15",
  "version": "v1",
  "data": {
  	"name": "Test",
"phone": "9999999999",
"email": "[email protected]",
  	"verification_id": "testverificationid",
  	"reference_id": 235461,
  	"link_expiry": "2025-12-02",
  	"form_link": "https://forms.cashfree.com/",
  	"form_status": "EXPIRED",
"verification_details": [
    	{
      		      "reference_id": 234,
      "type": "OFFLINE_AADHAAR_VERIFICATION",
      "status": "SUCCESS"
    		},
    		{
    		      "reference_id": 0,
      "type": "PANDETAILS_VERIFICATION",
      "status": "EXPIRED"
},
    		{
      "reference_id": 236,
      "type": "BANKDETAILS_VALIDATION",
      "status": "SUCCESS"
    		},
    		{
      "reference_id": 0,
      "type": "UPIDETAILS_VALIDATION",
      "status": "EXPIRED"
    		}
  	]
     }
}

Signature verification

Verifying the signature is mandatory before processing any response. It helps authenticate that the webhook is from Cashfree Payments.

Follow the steps to verify the signature:

Sort the array based on keys.
Concatenate all the values in this array and the resultant is the post data (postData).
postData needs to be encrypted using SHA-256 and then base64 encoded.
Verify if both the signature calculated and the signature received match.
Proceed further only if the signatures match. If not, discard the request.
Ensure clientSecret you use is from the oldest active key pair.

For example, from the webhook received, extract the data and pass it to generate HMAC function:

{bank_account=026291800001191, ifsc=YESB0000262, upi=, name_at_bank=John Doe, 
verification_id=fadsfdsf, ref_id=332, utr=332, status=SUCCESS,
added_on=2023-09-06T07:48:53+05:30, processed_on=2023-09-06 07:49:03, 
penny_collected_on=2023-09-06 07:48:53}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.util.Map;
import java.util.TreeMap;

import com.fasterxml.jackson.core.type.TypeReference;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.apache.commons.codec.binary.Base64;

public class ComputedSignature {
public static String generateHMAC(String clientSecret, String data) {
        String hash = null;
        ObjectMapper objectMapper = new ObjectMapper();
        try {
            Map<String, Object> jsonMap = objectMapper.readValue(data, new TypeReference<Map<String, Object>>() {
            });
            Map<String, Object> sortedMap = new TreeMap<>(jsonMap);

            // sort the map based on keys
            String postDataString = "";

            for (Map.Entry<String, Object> entry : sortedMap.entrySet()) {
                postDataString = postDataString + entry.getValue();
            }

            // encode the post data on sha256
            Mac sha256HMAC = Mac.getInstance("HmacSHA256");
            SecretKeySpec secretKey = new SecretKeySpec(clientSecret.getBytes(), "HmacSHA256");
            sha256HMAC.init(secretKey);

            hash = Base64.encodeBase64String(sha256HMAC.doFinal(postDataString.getBytes()));
        } catch (Exception e) {
            e.printStackTrace();

        }
        return hash;
    }
}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.util.Map;
import java.util.TreeMap;

import com.fasterxml.jackson.core.type.TypeReference;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.apache.commons.codec.binary.Base64;

public class ComputedSignature {
public static String generateHMAC(String clientSecret, String data) {
        String hash = null;
        ObjectMapper objectMapper = new ObjectMapper();
        try {
            Map<String, Object> jsonMap = objectMapper.readValue(data, new TypeReference<Map<String, Object>>() {
            });
            Map<String, Object> sortedMap = new TreeMap<>(jsonMap);

            // sort the map based on keys
            String postDataString = "";

            for (Map.Entry<String, Object> entry : sortedMap.entrySet()) {
                postDataString = postDataString + entry.getValue();
            }

            // encode the post data on sha256
            Mac sha256HMAC = Mac.getInstance("HmacSHA256");
            SecretKeySpec secretKey = new SecretKeySpec(clientSecret.getBytes(), "HmacSHA256");
            sha256HMAC.init(secretKey);

            hash = Base64.encodeBase64String(sha256HMAC.doFinal(postDataString.getBytes()));
        } catch (Exception e) {
            e.printStackTrace();

        }
        return hash;
    }
}