Callback URL Setup

The IIMMPACT platform supports webhook notifications for asynchronous event updates, such as transaction status changes. To receive these notifications, you must configure a Callback URL. This URL is a secure HTTPS endpoint on your server that IIMMPACT will call with relevant event data.

Transaction Callbacks vs Catalog Webhooks

This page describes transaction callbacks (triggered by payment status changes). These are separate from catalog webhooks, which notify you of product catalog changes and include HMAC signature verification.

Configure your callback URL

From the Developer > Webhooks page:

1. Under Webhook Configuration, enter your callback URL.
2. Choose the HTTP method — POST or GET.
3. Click Save.

Requirements

• Your endpoint must be publicly reachable.
• Use HTTPS for security.
• Return a 2xx response quickly to acknowledge receipt.

What Triggers a Callback?

IIMMPACT sends a callback when a transaction's status changes. The payload includes the current status — Processing, Succesful, or Failed — along with the full transaction details.

For the complete payload format and field descriptions, see Sample Callback Response.

Security

Transaction callbacks do not include a signature. Verify authenticity by allowlisting IIMMPACT callback IPs, matching the refid against your pending transactions, and optionally re-querying the transaction status. HMAC signature verification is planned.

Retry Behavior

If your endpoint fails to respond, IIMMPACT will retry the callback:

Setting	Value
Timeout	30 seconds per request
Retry limit	3 retries
Retry delay	60 seconds between attempts

What triggers a retry:

• HTTP 5xx (server errors)
• HTTP 429 (rate limited)
• HTTP 408 (timeout)
• Network errors (connection refused, DNS failure, timeout)

What does NOT retry:

• HTTP 4xx client errors (except 408/429) — these are treated as permanent failures

WARNING

If delivery fails, we retry up to 3 times with 60-second delays. You'll be notified via email/WhatsApp on the first failure (once per 24 hours). Failed callbacks are logged and monitored. Ensure your endpoint returns 2xx within 30 seconds to avoid delivery issues.

WARNING

If your server uses IP allowlisting, you must allowlist IIMMPACT's callback IPs. See Sample Callback Response for the full list.

TIP

You can also configure the callback URL programmatically via the Set Callback URL API or retrieve your current settings via the Get Callback URL API.