Webhooks

Optional HTTPS callback. When a payment finishes, Sifalo POSTs a verify-style JSON body to your webhook_url. You don’t have to poll — but verify stays available as a backup.

📘
Works for the e-Wallet API and hosted checkout. On checkout, pass webhook_url together with return_url when you request key + token. return_url is still the browser redirect.

1. Expose an endpoint

Host a public HTTPS URL that accepts POST with Content-Type: application/json, updates your order, and returns HTTP 200 quickly.

2. Send `webhook_url`

e-Wallet API

Send your own order_id so you can match the callback to the order.

curl -X POST "https://api.sifalopay.com/gateway/" \
  -u "$SIFALO_API_USER:$SIFALO_API_KEY" \
  -H "Content-Type: application/json" \
  --max-time 120 \
  -d '{
    "account": "25262XXXXXXX",
    "gateway": "edahab",
    "amount": "100",
    "currency": "USD",
    "order_id": "ORD-1001",
    "webhook_url": "https://merchant.example.com/hooks/sifalopay"
  }'

You still get the normal charge response (code, sid, response). The webhook is an extra push.

Hosted checkout

Pass webhook_url on the checkout start call (with return_url). We push after the customer pays on the checkout page (wallet or card).

curl -X POST "https://api.sifalopay.com/gateway/" \
  -u "$SIFALO_API_USER:$SIFALO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": "22",
    "gateway": "checkout",
    "currency": "USD",
    "return_url": "https://merchant.example.com/pay/return?order_id=ORD-1001",
    "webhook_url": "https://merchant.example.com/hooks/sifalopay"
  }'

3. Handle the POST

Mark paid only when status is success and code is 601. amount is what the customer paid.

{
  "sid": "ABCDEF",
  "order_id": "ORD-1001",
  "account": "25262XXXXXXX",
  "payment_type": "EDAHAB",
  "amount": "100",
  "currency": "USD",
  "response": "Your Transaction has been Processed!",
  "status": "success",
  "code": 601
}

Example receiver:

<?php
$data = json_decode(file_get_contents('php://input'), true);

if (($data['status'] ?? '') === 'success' && (int) ($data['code'] ?? 0) === 601) {
    // mark order paid using $data['order_id'] and $data['sid']
}

http_response_code(200);
echo 'OK';

Paid = 601. Pending = 603 (ask the customer to approve; you can still poll verify). Full list: Decline codes.

Limits

Fires once when that charge call completes (601 / 603 / 600 / 604).
If a payment later moves from pending to paid outside that request, we do not send a second webhook — use verify.
Do not use checkout return_url or plugin url as webhook_url.

e-Wallet API

Charge, read the code, verify

Hosted checkout

Start session with return_url + webhook_url

Decline codes

Full status code list

Sandbox

Staging hosts and test wallets

1. Expose an endpoint

2. Send webhook_url

e-Wallet API

Hosted checkout

3. Handle the POST

Limits

Next

2. Send `webhook_url`