Create Payout Request Control Checksum

NOTE: Never expose your partner_control provided by us to anyone. Doing so will compromise the security of future transaction.

SHA-1 checksum is used in ensuring data integrity and message authenticity in communication. This checksum is calculated by concatenating the data in transaction request/response in the correct order and append the shared secret (partner_control) to the end of concatenating string, feed it into SHA-1 function and supply the SHA-1 function result in control parameter of the request.

For more details of Secure Hash Algorithm 1 (SHA1), see clickhere

To create the checksum, concatenate the value of the following parameters into one string variable in the following order:
(merchant_account + merchant_order + amount + currency + Base64.encoded(customer_name) + bank_code + bank_account_number + partner_control)

Below example to verify checksum:
merchant_account 900136
merchant_order 12345
amount 10000
currency PHP
customer_name Juan Dela Cruz -> Base64.encode('Juan Dela Cruz') -> SnVhbiBEZWxhIENydXo=
bank_code SPP_GXCHPHM2
bank_account_number 09123456789
partner_control 792fef0e5c422b69cff20229d8ac5ca2f497ba44

The complete string for above example data becomes as follows:
9001361234510000PHPSnVhbiBEZWxhIENydXo=SPP_GXCHPHM209123456789

For this example partner_control key is: 73C76D7B2B090C7EEBBA3CFD26782AA0

Then hash the string using the SHA-1 hash function (Example below):
sha1(‘SHA1’, ‘9001361234510000PHPSnVhbiBEZWxhIENydXo=SPP_GXCHPHM20912345678973C76D7B2B090C7EEBBA3CFD26782AA0’)

Then supply this string and the partner control as the key to SHA-1 function. And supply the result to control parameter, the last parameter you need to initiate the transaction. In our example, the control parameter would become:

792fef0e5c422b69cff20229d8ac5ca2f497ba44

Payout Callback Response

Once the payout transaction is processed and fund are sent to customer bank account, final transaction result is return to the merchant if status_callback_url is supplied in the credit transaction request. Merchant shall record the information for future reference and reconciliation. The table below explains the parameters that are delivered by HTTP POST request in JSON format.

# Callback response example :
{
    "transaction_id": 1103795,
    "merchant_account": "900136",
    "merchant_order": "12345",
    "amount": 10000,
    "currency": "PHP",
    "customer_name": "Juan Dela Cruz",
    "bank_code": "SPP_GXCHPHM2",
    "bank_account_number": "09123456789",
    "status": "A0",
    "message": "Paid / Refunded / Successfully requested.",
    "control": "9fa407db8267c024330421980eeb35dbfd911465"
}
                

CALLBACK RESPONSE PARAMETERS IN JSON BODY

Validate your Payout Callback Response by matching Control Checksum

SHA-1 checksum is used in ensuring data integrity and message authenticity in communication. This checksum is calculated by concatenating the data in transaction request/response in the correct order and append the shared secret (partner_control) to the end of concatenating string, feed it into SHA-1 function and supply the SHA-1 function result in control parameter of the request.

To create the checksum from callback response, concatenate the value of the following parameters into one string variable in the following order:
(transaction_id + merchant_account + merchant_order + amount + currency + status)

Below example to verify checksum:
transaction_id 1103795
merchant_account 900136
merchant_order 12345
amount 10000
currency PHP
status A0

The complete string for above example data becomes as follows:
1103795123451000010000PHPA0

For this example partner_control key is: 73C76D7B2B090C7EEBBA3CFD26782AA0

Then hash the string using the SHA-1 hash function (Example below):
sha1(‘SHA1’, ‘1103795123451000010000PHPA073C76D7B2B090C7EEBBA3CFD26782AA0’)

Then use this string and the (partner_control) to SHA-1 function. And use the result of it to verify authenticity of communication response you got as callback. In our example, the control parameter would become:

9fa407db8267c024330421980eeb35dbfd911465