Push Payments Callback.

This push notification mechanism allows merchants to receive payment confirmation without relying on browser redirects or client-side actions.

Overview

The Push Payments Callback (pushPayments) is a server-to-server notification sent by DPO to the merchant’s backend system when a payment has been successfully processed.

This ensures reliable transaction confirmation even if:

The customer closes the browser
The redirect flow fails
Network issues interrupt the checkout process
The payment occurs on a different device

Merchants should treat this notification as the authoritative payment result.

When is the callback sent?

The pushPayments notification is sent:

After a successful payment authorisation
To the callback URL configured for your merchant account
Independently of any customer redirect flow

⚠️
The notification is not triggered for failed or cancelled payments unless specifically configured.

Endpoint requirements

Your system must expose a publicly accessible HTTPS endpoint capable of receiving HTTP POST requests from DPO.

Requirements

Must support HTTPS
Must accept POST requests
Should respond quickly (recommended < 5 seconds)
Must return a valid HTTP 200 response to acknowledge receipt

Failure to respond correctly may result in retries or missed confirmations.

Request format

The callback is sent as a POST request containing transaction details in the request body.

Typical information includes:

Merchant reference / order ID
Transaction ID
Payment status
Amount
Currency
Payment method
Timestamp

The exact fields may vary depending on your integration and configuration.

Example callback payload

{
  "transactionId": "123456789",
  "merchantOrderId": "ORDER_12345",
  "status": "SUCCESS",
  "amount": 1000,
  "currency": "ZAR",
  "paymentMethod": "CARD",
  "timestamp": "2026-02-17T08:45:12Z"
}

Handling the callback

Upon receiving the notification, your system should:

Validate the request source (if IP allowlisting or signatures are used)
Verify the transaction details against your records
Update the order status in your system
Trigger fulfilment processes if applicable
Return an HTTP 200 OK response

⚠️
Do not rely solely on browser redirects for payment confirmation.

Recommended verification step

For critical operations, merchants should confirm the transaction status using the Transaction Status Lookup API before fulfilling the order.

This protects against:

Duplicate notifications
Tampered requests
Network retries
Edge-case failures

Idempotency considerations

Your system should handle duplicate notifications safely.

Implement idempotent processing using the transaction ID or merchant order ID to ensure that repeated callbacks do not result in duplicate fulfilment.

Security considerations

To protect your system:

Validate incoming requests from trusted sources
Implement IP allowlisting if provided by DPO
Use HTTPS only
Avoid exposing internal systems directly
Log callback activity for audit purposes

Contact DPO support for recommended security configurations.

Failure handling

If your endpoint does not respond successfully:

DPO may retry delivery (depending on configuration)
The transaction will still be considered successful on DPO’s side
Merchants should reconcile transactions using status lookup tools

Related documentation