The webhook payload

Every payment webhook is a JSON body with a top-level event envelope and a data object describing the payment. The same shape is used for all payment events; only event_type and the payment fields change.

Example payload

{
  "event_id": "9d96b4b9-27b8-4677-8615-5e16d689d596",
  "event_type": "SUCCESS",
  "created_at": "2026-08-24T10:00:00.000Z",
  "data": {
    "ref_id": "XPABC123",
    "order_id": "merchant-order-123",
    "description": "Annual membership",
    "status": "SUCCESS",
    "amount": 500,
    "currency": "INR",
    "utr": "312482855519",
    "customer_name": "Asha Sharma",
    "customer_email": "[email protected]",
    "created_at": "2026-08-24T09:50:00.000Z",
    "completed_at": "2026-08-24T10:00:00.000Z",
    "expires_at": "2026-08-24T10:00:00.000Z"
  }
}

Fields

Field	Type
`event_id`	UUID string
`event_type`	One of the payment event names
`created_at` (top level)	ISO-8601 timestamp
`data.ref_id`	string
`data.order_id`	string or null
`data.description`	string or null
`data.status`	Payment status
`data.amount`	number; whole rupees
`data.currency`	Always `INR`
`data.utr`	string or null
`data.customer_name`	string or null
`data.customer_email`	string or null
`data.created_at`	ISO-8601 timestamp
`data.completed_at`	ISO-8601 timestamp or null
`data.expires_at`	ISO-8601 timestamp

Request headers

Every delivery includes these headers. Use X-Xenonpay-Event-Id to deduplicate retried deliveries.

Content-Type: application/json
X-Xenonpay-Event: SUCCESS
X-Xenonpay-Event-Id: 9d96b4b9-27b8-4677-8615-5e16d689d596

When you have a signing secret configured, we also send X-Xenonpay-Signature. See Verifying webhook signatures.

The payload never includes the session token, customer phone number, payer IP, bank-account details, or payment proof.

Was this helpful?