XoomPe Client Payments API

const response = await fetch('{{base_url}}/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    clientId: '{{client_id}}',
    clientSecret: '{{client_secret}}'
  })
});
const data = await response.json();

import requests
response = requests.post('{{base_url}}/token', json={
  'clientId': '{{client_id}}',
  'clientSecret': '{{client_secret}}'
})
data = response.json()

$ch = curl_init('{{base_url}}/token');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
  'clientId' => '{{client_id}}',
  'clientSecret' => '{{client_secret}}'
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);

const response = await fetch('{{base_url}}/refresh', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ refreshToken: '{{refresh_token}}' })
});
const data = await response.json();

import requests
response = requests.post('{{base_url}}/refresh', json={'refreshToken': '{{refresh_token}}'})
data = response.json()

$ch = curl_init('{{base_url}}/refresh');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(['refreshToken' => '{{refresh_token}}']));
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);

const response = await fetch('{{base_url}}/Payout/getWalletBalance', {
  headers: { 'Authorization': 'Bearer {{access_token}}' }
});
const data = await response.json();

import requests
response = requests.get('{{base_url}}/Payout/getWalletBalance',
  headers={'Authorization': 'Bearer {{access_token}}'}
)
data = response.json()

$ch = curl_init('{{base_url}}/Payout/getWalletBalance');
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Authorization: Bearer {{access_token}}']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);

const response = await fetch('{{base_url}}/Payout/CreateTransaction', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer {{access_token}}',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    beneficiaryName: 'John Doe',
    beneficiaryAccountNumber: '123456789012',
    ifsc: 'ABCD0123456',
    amount: 5000,
    clientTransactionRefNo: 'INV-1001'
  })
});
const data = await response.json();

import requests

response = requests.post(
  '{{base_url}}/Payout/CreateTransaction',
  headers={'Authorization': 'Bearer {{access_token}}'},
  json={
    'beneficiaryName': 'John Doe',
    'beneficiaryAccountNumber': '123456789012',
    'ifsc': 'ABCD0123456',
    'amount': 5000,
    'clientTransactionRefNo': 'INV-1001'
  }
)
data = response.json()

$ch = curl_init('{{base_url}}/Payout/CreateTransaction');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
  'beneficiaryName' => 'John Doe',
  'beneficiaryAccountNumber' => '123456789012',
  'ifsc' => 'ABCD0123456',
  'amount' => 5000,
  'clientTransactionRefNo' => 'INV-1001'
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'Authorization: Bearer {{access_token}}',
  'Content-Type: application/json'
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);

const response = await fetch('{{base_url}}/Payout/CreateBulkTransactions', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer {{access_token}}',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    transactions: [
      { beneficiaryName:'A Person', beneficiaryAccountNumber:'1234567890', ifsc:'ABCD0123456', amount:5000, clientTransactionRefNo:'BULK-1' },
      { beneficiaryName:'B Person', beneficiaryAccountNumber:'9876543210', ifsc:'WXYZ0123456', amount:7500, clientTransactionRefNo:'BULK-2' }
    ]
  })
});
const data = await response.json();

import requests

response = requests.post(
  '{{base_url}}/Payout/CreateBulkTransactions',
  headers={'Authorization': 'Bearer {{access_token}}'},
  json={
    'transactions': [
      {'beneficiaryName':'A Person','beneficiaryAccountNumber':'1234567890','ifsc':'ABCD0123456','amount':5000,'clientTransactionRefNo':'BULK-1'},
      {'beneficiaryName':'B Person','beneficiaryAccountNumber':'9876543210','ifsc':'WXYZ0123456','amount':7500,'clientTransactionRefNo':'BULK-2'}
    ]
  }
)
data = response.json()

$ch = curl_init('{{base_url}}/Payout/CreateBulkTransactions');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
  'transactions' => [
    ['beneficiaryName'=>'A Person','beneficiaryAccountNumber'=>'1234567890','ifsc'=>'ABCD0123456','amount'=>5000,'clientTransactionRefNo'=>'BULK-1'],
    ['beneficiaryName'=>'B Person','beneficiaryAccountNumber'=>'9876543210','ifsc'=>'WXYZ0123456','amount'=>7500,'clientTransactionRefNo'=>'BULK-2']
  ]
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'Authorization: Bearer {{access_token}}',
  'Content-Type: application/json'
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);

const url = new URL('{{base_url}}/Payout/GetClientTransactionsWithFilters');
url.searchParams.set('page', '1');
url.searchParams.set('pageSize', '50');
url.searchParams.set('status', 'Success');
url.searchParams.set('startDate', '2026-01-01');
url.searchParams.set('endDate', '2026-01-31');

// Optional: add more filters as needed
// url.searchParams.set('beneficiaryName', 'John');
// url.searchParams.set('minAmount', '5000');
// url.searchParams.set('maxAmount', '100000');
// url.searchParams.set('utr', 'UTR123');
// url.searchParams.set('batchStatus', 'unbatched');

const response = await fetch(url, {
  headers: { 'Authorization': 'Bearer {{access_token}}' }
});
const data = await response.json();

import requests

response = requests.get(
  '{{base_url}}/Payout/GetClientTransactionsWithFilters',
  headers={'Authorization': 'Bearer {{access_token}}'},
  params={
    'page': 1,
    'pageSize': 50,
    'status': 'Success',
    'startDate': '2026-01-01',
    'endDate': '2026-01-31',
    # Optional filters:
    # 'beneficiaryName': 'John',
    # 'minAmount': 5000,
    # 'maxAmount': 100000,
    # 'utr': 'UTR123',
    # 'batchStatus': 'unbatched',
  }
)
data = response.json()

$params = http_build_query([
  'page'      => 1,
  'pageSize'  => 50,
  'status'    => 'Success',
  'startDate' => '2026-01-01',
  'endDate'   => '2026-01-31',
  // Optional filters:
  // 'beneficiaryName' => 'John',
  // 'minAmount' => 5000,
  // 'maxAmount' => 100000,
  // 'utr' => 'UTR123',
  // 'batchStatus' => 'unbatched',
]);
$ch = curl_init("{{base_url}}/Payout/GetClientTransactionsWithFilters?{$params}");
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Authorization: Bearer {{access_token}}']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);

const response = await fetch('{{base_url}}/Payout/GetTransactionByTxnId/TX26010300001', {
  headers: { 'Authorization': 'Bearer {{access_token}}' }
});
const data = await response.json();

import requests
response = requests.get(
  '{{base_url}}/Payout/GetTransactionByTxnId/TX26010300001',
  headers={'Authorization': 'Bearer {{access_token}}'}
)
data = response.json()

$ch = curl_init('{{base_url}}/Payout/GetTransactionByTxnId/TX26010300001');
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Authorization: Bearer {{access_token}}']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);

const clientRefNo = 'INV-1001';
const response = await fetch(`{{base_url}}/Payout/GetTransactionByClientRef/${clientRefNo}`, {
  headers: { 'Authorization': 'Bearer {{access_token}}' }
});
const data = await response.json();

import requests

client_ref_no = 'INV-1001'
response = requests.get(
  f'{{base_url}}/Payout/GetTransactionByClientRef/{client_ref_no}',
  headers={'Authorization': 'Bearer {{access_token}}'}
)
data = response.json()

$clientRefNo = 'INV-1001';
$ch = curl_init("{{base_url}}/Payout/GetTransactionByClientRef/{$clientRefNo}");
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Authorization: Bearer {{access_token}}']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);

import hmac
import hashlib
import time
from flask import Flask, request, abort

app = Flask(__name__)
WEBHOOK_SECRET = 'your-webhook-secret'

@app.route('/webhook', methods=['POST'])
def webhook():
    # Flask normalises headers — both forms work, but lowercase matches actual delivery
    sig       = request.headers.get('x-webhook-signature', '')
    timestamp = request.headers.get('x-webhook-timestamp', '0')

    # Reject stale webhooks (older than 5 minutes)
    if abs(time.time() - int(timestamp)) > 300:
        abort(400, 'Stale webhook')

    raw_body = request.get_data()          # raw bytes — do NOT decode/parse first
    expected = hmac.new(
        WEBHOOK_SECRET.encode('utf-8'),
        raw_body,
        hashlib.sha256
    ).hexdigest()                          # lowercase hex — matches server output

    if not hmac.compare_digest(expected, sig):
        abort(401, 'Invalid signature')

    payload = request.get_json()
    # payload['status']    → "Success" | "Failed" | "Cancelled"
    # payload['utr']       → UTR string or None
    # payload['timestamp'] → Unix epoch int
    print('Status:', payload['status'], '| UTR:', payload.get('utr'))
    return 'OK', 200

<?php
$secret    = 'your-webhook-secret';
$sig       = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$timestamp = $_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'] ?? 0;

// Reject stale webhooks (older than 5 minutes)
if (abs(time() - (int)$timestamp) > 300) {
    http_response_code(400);
    exit('Stale webhook');
}

$rawBody  = file_get_contents('php://input');
$expected = hash_hmac('sha256', $rawBody, $secret);

if (!hash_equals($expected, $sig)) {
    http_response_code(401);
    exit('Invalid signature');
}

$payload = json_decode($rawBody, true);
error_log('Status: ' . $payload['status'] . ' UTR: ' . ($payload['utr'] ?? 'N/A'));
http_response_code(200);
echo 'OK';