# Transaction notification

> POST to your notification URL
> Sent by Ozow. Part of the Payments API reference. Source: https://hub.ozow.com/api-reference/payments-api/webhooks/transaction-notification/

Sent to the notification URL once a transaction reaches a final status.

The URL comes from the `NotifyUrl` field on the payment request, or from the site configuration in the merchant admin site. Without one, no notification is sent.

Verify the `Hash` field before acting on the contents. A notification is an unauthenticated POST to a URL that anyone can call.

## Authentication

Ozow sends no credential with this call, so this check is the only thing standing between a real delivery and a stranger’s. Verify the Hash field before acting on the contents: your notification URL is public, and anyone can post to it.

## Payload

**application/x-www-form-urlencoded**

- `SiteCode` (string, required, max length 50) - The site code sent to Ozow in the request post.
- `TransactionId` (string, uuid, required, max length 50) - The transaction identifier generated by Ozow.
- `TransactionReference` (string, required, max length 50) - The merchant's transaction reference sent in the request post's TransactionReference variable.
- `Amount` (number, double, required) - The transaction amount, always written with two decimal places. That is the form the hash is built from, so use the value exactly as it was posted.
- `Status` (string, required, max length 50) - The transaction status. Possible values are: 1. Complete - The payment was successful. 2. Cancelled - The payment was cancelled. 3. Error - An error occurred while processing the payment. 4. Abandoned – The payment was abandoned. 5. PendingInvestigation – An inconclusive result was received by the bank and the payment needs to be verified manually. 6. Pending – The status cannot be determined as yet but will be reposted to the notification URL as soon as it has been determined. Merchants not using the notification URL will receive a PendingInvestigation status.
- `Optional1` (string, max length 50) - Optional fields sent in the request post.
- `Optional2` (string, max length 50) - Optional fields sent in the request post.
- `Optional3` (string, max length 50) - Optional fields sent in the request post.
- `Optional4` (string, max length 50) - Optional fields sent in the request post.
- `Optional5` (string, max length 50) - Optional fields sent in the request post.
- `CurrencyCode` (string, required, max length 3, pattern ^[A-Z]+) - The transaction currency code sent in the request post.
- `IsTest` (string, max length 5) - Whether the transaction was a test transaction, sent as `True` or `False`. Part of the hash, so use the value exactly as it was posted.
- `StatusMessage` (string, max length 500) - A message about the status, empty for most transactions. Part of the hash, so an empty value still counts as a field and contributes an empty string.
- `Hash` (string, required, max length 128) - SHA512 hash used to ensure that certain fields in the message have not been altered after the hash was generated. See the generate hash section for more details on how to validate the response variables using the hash.
- `SubStatus` (string, max length 50) - The transaction sub status for failed transactions. The value provides an indication as to why the payment failed. Some examples: • Unclassified – Failure scenario has not been mapped • InsufficientFunds - User did not have sufficient funds available to complete the payment While there are several sub-statuses, they have not been included here as they are strictly for reporting.
- `MaskedAccountNumber` (string, max length 50) - The masked account number the payment was made from. If account number is 12 or more digits then the first and last four digits are unmasked e.g. 1234567898765 will be masked as 1234*****8765 If the account number is less than12 digits then the first and last 3 digits are left unmasked e.g. 123456789 will be masked as 123***789 **This is not available by default and a request by the merchant must be submitted along with a justification for requiring this information.**
- `BankName` (string, max length 50) - The name of the bank the payment was made from.
- `SmartIndicators` (string, max length 500) - Some Ozow merchants have requested this information as they use this in their own processes. The can be ignored unless you have a purpose and application for this information. The application of these indicators are for the merchant’s discretion and in isolation do not constitute any action to be taken by the merchant. The field will contain a pipe delimited list of the following values if they are applicable e.g. HIGH_VALUE | FIRST_OZOW : * HIGH_VALUE – If a soft limit is configured on the site and the amount paid is higher or equal to the configured limit * FIRST_OZOW – First time a user has paid using Ozow * FIRST_MERCHANT – First time a user has paid the merchant using Ozow * NEW_OZOW – User has paid using Ozow for the first time in the past seven days * NEW_MERCHANT - User has paid the merchant using Ozow for the first time in the past seven days

## Your response

### 200 Acknowledged. Return this once you have stored the notification.

No body.