> For the complete documentation index, see [llms.txt](https://docs.vpay.africa/vpay-api-specification-basic-gude/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vpay.africa/vpay-api-specification-basic-gude/inbound-webhook-notifications.md).

# Inbound Webhook Notifications

## Webhook JSON Payload Sample

Notifications will be sent to your registered webhook for each bank transfer that is received by your customer accounts. The JSON sample below captures the structure of the payload to expect.  NOTE: The http method for your web hook should be POST.

{% hint style="info" %}
Web hook notifications will be sent repeatedly (up to 10 times) at regular intervals until a successful response is received from your pre-registered web hook endpoint.
{% endhint %}

{% hint style="danger" %}
In the event of multiple notifications, to prevent duplicate updates to your  ledger, ALWAYs store and enforce a check on **session\_id** for new **bank transfer** notifications. **session\_id** is unique per transfer transaction and so a notification payload with an existing **session\_id** should be disregarded.
{% endhint %}

```json
{
    reference: "efc2-g2dd-fvvb",
    session_id: "000015230313003808229026004700",
    amount: 100,
    fee: 1,
    account_number: "4600577949",
    originator_account_number: "4600000000",
    originator_account_name: "Emeka Ajibade",
    originator_bank: "0000014",
    timestamp: "2021-06-30T23:48:49.197+00:00"
}
```

**Payload Verification – Secret Key Authentication**

Your webhook data payload will be sent along with a JWT token containing **{secret: your\_secret\_key}** as its payload. This token will be placed in the request header called **x-payload-auth**.

{% hint style="danger" %}
Always verify that the payload to your webhook is coming with this token deconstructed to  **{secret: your\_secret\_key}.** Reject the payload if verification fails.
{% endhint %}