To register the Webhook URL, you will need to contact RocketFuel sales team.
The callback URL should respond with status 200 for GET request.
Rocketfuel Webhook and Events
RocketFuel webhook calls are triggered to update the merchant on the status of the payouts and the payees.
Rocketfuel webhooks support the following events:-
PayeeAdded: This event is triggered when a new payee is successfully added to the system. It confirms that the payee's information has been registered and is ready for further action.
PayeeKycStarted: This webhook is triggered when the Know Your Customer (KYC) process for a payee begins. It signifies that the verification process for the payee's identity has been initiated.
PayeeKycStatusChange: This event is sent whenever there is a change in the payee’s KYC status. It updates the current status of the verification process, such as whether it has been approved, rejected, or is pending further action.
PayeeFundAllocated: This webhook is triggered when funds are successfully allocated to the payee. It signifies that the funds intended for the payout have been reserved.
PayoutStarted: This event is triggered when the payout process begins. It confirms that the payout has been initiated for the payee and the payment is in progress.
PayoutStatusChange: This webhook is sent when there is a change in the status of a payout. It provides updates on the current state of the payout, such as successful completion, failure, or being in progress.
Securing Callbacks
Order callbacks originating from RocketFuel will be signed using our callback signing RSA private key.
If you would like to verify callbacks manually in the language of your choice, the message digest used is SHA256, the message that is signed is the POST body, the padding scheme is PKCS1_v1_5, and the signature to be verified is present in the ‘signature’ HTTP data encoded as base64.
Examples
public function verifyCallback($body, $signature)
{
$signature_buffer = base64_decode( $signature );
return (1 == openssl_verify($body, $signature_buffer, self::getCallbackPublicKey(), OPENSSL_ALGO_SHA256));
}
import java.nio.charset.StandardCharsets;
import java.security.KeyFactory;
import java.security.PublicKey;
import java.security.Signature;
import java.security.spec.X509EncodedKeySpec;
import java.util.Base64;
public class WebhookVerifier {
// The public key string (including header/footer)
private static final String PUBLIC_KEY_STRING =
"-----BEGIN PUBLIC KEY-----\n" +
"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2e4stIYooUrKHVQmwztC\n" +
"/l0YktX6uz4bE1iDtA2qu4OaXx+IKkwBWa0hO2mzv6dAoawyzxa2jmN01vrpMkMj\n" +
"rB+Dxmoq7tRvRTx1hXzZWaKuv37BAYosOIKjom8S8axM1j6zPkX1zpMLE8ys3dUX\n" +
"FN5Dl/kBfeCTwGRV4PZjP4a+QwgFRzZVVfnpcRI/O6zhfkdlRah8MrAPWYSoGBpG\n" +
"CPiAjUeHO/4JA5zZ6IdfZuy/DKxbcOlt9H+z14iJwB7eVUByoeCE+Bkw+QE4msKs\n" +
"aIn4xl9GBoyfDZKajTzL50W/oeoE1UcuvVfaULZ9DWnHOy6idCFH1WbYDxYYIWLi\n" +
"AQIDAQAB\n" +
"-----END PUBLIC KEY-----";
/**
* Loads a PublicKey from a PEM-formatted string.
*
* @param keyStr the PEM public key string
* @return the PublicKey instance
* @throws Exception if any error occurs during parsing
*/
public static PublicKey loadPublicKey(String keyStr) throws Exception {
// Remove the PEM header and footer, and any whitespace/newlines.
String publicKeyPEM = keyStr
.replace("-----BEGIN PUBLIC KEY-----", "")
.replace("-----END PUBLIC KEY-----", "")
.replaceAll("\\s", "");
// Base64-decode the result
byte[] decoded = Base64.getDecoder().decode(publicKeyPEM);
// Generate the public key
X509EncodedKeySpec spec = new X509EncodedKeySpec(decoded);
KeyFactory kf = KeyFactory.getInstance("RSA");
return kf.generatePublic(spec);
}
/**
* Verifies the RSA-SHA256 signature for the given payload.
*
* @param body the message to verify (payload)
* @param signature the Base64-encoded signature string
* @param publicKey the public key used for verification
* @return true if the signature is valid; false otherwise
* @throws Exception if any error occurs during verification
*/
public static boolean verifySignature(String body, String signature, PublicKey publicKey) throws Exception {
Signature sig = Signature.getInstance("SHA256withRSA");
sig.initVerify(publicKey);
// Update the signature object with the bytes of the body
sig.update(body.getBytes(StandardCharsets.UTF_8));
// Decode the signature from Base64
byte[] sigBytes = Base64.getDecoder().decode(signature);
// Verify the signature and return the result
return sig.verify(sigBytes);
}
public static void main(String[] args) {
// Sample payload: the 'data' field from your JSON webhook
String payloadData = "{\"data\":{\"payeeId\":\"ba2fb7c7-a94f-491a-9538-83a170557748\"," +
"\"payeeInternalId\":\"\",\"payoutAmount\":0.00008697," +
"\"payoutCurrency\":\"BTC\",\"payoutId\":\"e4c356dc-8fba-4713-9a00-7845d2c48c35\"," +
"\"type\":\"crypto\"},\"event\":\"PayoutStarted\"," +
"\"timestamp\":\"2024-07-16T12:46:30.061Z\"}";
// The Base64-encoded signature from your webhook
String signature = "h5EZnyA8v/24knUfnEka4QwgXeUQOb7XE21Duy5W8uV6o1g/7J2sB4gK31NAaXt3cz4TBgW0dA59LNvRogO+VUb6gzj/8jvlDXFtUj5214/cPEBPnuSddW8dy66zuBL3vYviT1qc1it0uNVmXzh2GCjfhfJ2ti3CHDornmiu3AfSROiPf40oAknt1nOpBGqvLafLzLRAcfIHa/6SxsApgdGCP9QW0A9O3WH4+uUNvehdKdGZ2t0Cv9LJGLTekc7Be4k85Tu/SsBbr9l6/laZMeZ/vsQFCzWdvbirHg/O78OjzHeLiHCdeqMrhkwVQKPE2xm1HwDqp8TSPDaX6CiNng==";
try {
PublicKey publicKey = loadPublicKey(PUBLIC_KEY_STRING);
boolean isValid = verifySignature(payloadData, signature, publicKey);
System.out.println("Signature valid: " + isValid);
} catch (Exception e) {
e.printStackTrace();
}
}
}
Sample Webhook Payloads
Following is an example for GET & POST payload for the events:
Here’s a description for the two statuses related to KYC:
manual_review - Pending Status:
This status indicates that the payee’s KYC process is currently under manual review and pending approval. The verification is yet to be completed, and further checks or actions may be required before the KYC can be finalized.
completed - KYC is Done:
This status signifies that the KYC process has been completed. The payee has passed all necessary verification checks, and their identity has been confirmed as part of the KYC process.
You can test the authenticity of the request emerging from Rocketfuel by using the following public key to generate the signature. Once the signature is generated, you can tally the signature sent by Rocketfuel.
