Coda Payments Webhooks

generated: '2026-08-04'
method: searched
source: https://docs.coda.co/
spec_type: none
asyncapi_published: false
note: >-
  Coda Payments publishes no AsyncAPI document and no event-catalog spec. It does document
  a real webhook/notification surface across four products, captured here. Probed
  /asyncapi.yaml and /asyncapi.json alongside the OpenAPI probes on every Coda host on
  2026-08-04 with no hit.
docs:
- https://docs.coda.co/codapay/hosted-payment-page-integration/get-notified-of-a-transaction-status-change.md
- https://docs.coda.co/codapay/hosted-payment-page-integration/activate-post-notifications.md
- https://docs.coda.co/codapay/hosted-payment-page-integration/fraud-and-chargeback-notifications.md
- https://docs.coda.co/codapay/hosted-payment-page-integration/authorize-and-capture-a-payment-separately/auth-and-capture-notifications.md
- https://docs.coda.co/codapay/direct-api-integration/direct-api-integration-for-cards/get-notified-of-a-charge-status-change.md
- https://docs.coda.co/codapay/direct-api-integration/direct-api-integration-for-alternative-payment-methods/transaction-status-notification.md
- https://docs.coda.co/codapay/additional-features/refund-a-payment/get-notified-about-refund-status-changes.md
- https://docs.coda.co/codapay/additional-features/saving-card-details-new-notification.md
- https://docs.coda.co/codapay/archived-tokenization-api-2.0/webhooks-notification.md
- https://docs.coda.co/codapay/recurring-payments-coming-soon/webhook-notifications.md
- https://docs.coda.co/payout/integration-guides/api-reference/initiate-a-payout-request/notification.md
- https://docs.coda.co/codapay/integration-guides/security-guidelines.md
transport:
  style: HTTP callback to a partner-configured URL
  configuration: >-
    Transaction "Complete Notification URL" (also called the Callback URL) is set per title
    in the Publisher Portal under Products > Codapay > Sandbox/Production Configuration.
    Direct Card API charges instead carry a per-request setting.webhook_url /
    partner_webhook_url. Changes to portal URLs take effect immediately.
  payload_style: >-
    Hosted Payment Page notifications are query-string parameters appended to the callback
    URL (TxnId, OrderId, TotalPrice, PaymentType, ResultCode, Checksum, and USDPrice when
    USD Price Notification is enabled). Tokenization/Direct API notifications are JSON
    event objects.
  acknowledgement: >-
    Coda expects the partner to respond with ResultCode=0 on success, or an error code
    otherwise.
  retries:
    attempts: 3
    interval: 5 minutes
    on_exhaustion: an email alert is triggered
  integrity:
    mechanism: checksum parameter
    payin_formula: MD5(txnId + apiKey + orderId + resultCode)
    note: >-
      Separate checksum formulas are published for save-card notifications (v2 payin only)
      and for refund/chargeback notifications. Partners MUST validate the checksum before
      processing a notification — Coda warns that an unprotected notification URL lets an
      attacker fabricate payment transactions.
    source: https://docs.coda.co/codapay/integration-guides/security-guidelines.md
  subscription_management: >-
    Transaction notifications are subscribed to in the Publisher Portal under
    Team > Manage Access > "Transaction Notification".
channels:
- name: transaction-completion-notification
  api: Codapay Hosted Payment Page API
  direction: outbound-to-partner
  trigger: transaction reaches Successful or Failed
  optional_failure_delivery: >-
    Failed and expired transaction notifications are delivered only when the "Failed
    Notification" toggle is enabled in the portal configuration.
  parameters:
  - {name: TxnId, always: true, description: Coda transaction ID generated at initiation}
  - {name: OrderId, always: true, description: The partner order ID passed at initiation}
  - {name: TotalPrice, description: Transaction total}
  - {name: PaymentType, description: Payment channel ID used}
  - {name: ResultCode, description: 0 on success, otherwise a Codapay error code}
  - {name: Checksum, description: MD5 integrity checksum}
  - {name: USDPrice, description: Appended when USD Price Notification is enabled (currency 840)}
- name: auth-and-capture-notification
  api: Codapay Hosted Payment Page API / Hosted Components
  direction: outbound-to-partner
  trigger: authorization and capture state changes when auth and capture are performed separately
- name: fraud-and-chargeback-notification
  api: Codapay Hosted Payment Page API
  direction: outbound-to-partner
  trigger: fraud alert or chargeback raised on a transaction
- name: save-card-notification
  api: Codapay Hosted Payment Page API (v2 only)
  direction: outbound-to-partner
  trigger: a user adds or removes a saved payment method
- name: charge-status-notification
  api: Codapay Direct Card API
  direction: outbound-to-partner
  trigger: charge status change (authorization and capture)
  configuration_field: setting.webhook_url / partner_webhook_url on the charge request
- name: transaction-status-notification
  api: Codapay Direct API for Alternative Payment Methods
  direction: outbound-to-partner
  trigger: transaction status change through the shopper's payment flow
- name: refund-status-notification
  api: Codapay Refund API
  direction: outbound-to-partner
  trigger: refund status change
  description: >-
    "Merchants can receive real-time event data by providing URL endpoints to receive Event
    JSON Payloads via POST requests."
- name: payout-notification
  api: Coda Payout API
  direction: outbound-to-partner
  trigger: payout status change
- name: subscription-notification
  api: Codapay
  direction: outbound-to-partner
  note: No configuration required — Coda states the subscription notification URL needs no setup.
- name: recurring-payments-webhooks
  api: Codapay Recurring Payments
  status: coming-soon
  direction: outbound-to-partner
event_catalog:
  api: Codapay Tokenization API 2.0 (archived)
  source: https://docs.coda.co/codapay/archived-tokenization-api-2.0/webhooks-notification/types-of-events.md
  envelope: >-
    Event object carrying the event type plus the affected shopper / token / charge object.
  events:
  - name: shopper.created
    description: "Occurs whenever a shopper is created"
  - name: charge.created
    description: "Occurs whenever a charge is created"
  - name: token.created
    description: "Occurs whenever a token is created"
  - name: shopper.status.active
    description: "Occurs when a shopper status become active"
  - name: shopper.status.inactive
    description: "Occurs when a shopper status become inactive"
  - name: charge.status.blocked_charge_limit_exceeded
    description: "Occurs whenever charge amount limit exceeded"
  - name: charge.status.blocked_risk
    description: "Occurs when a charge is being blocked by risk"
  - name: charge.status.failed
    description: "Occurs whenever a charge failed"
  - name: charge.status.failed_insufficient_balance
    description: "Occurs when charge failed because of insufficient balance in the account"
  - name: charge.status.failed_shopper_cancel
    description: "Occurs when charge failed because shopper has canceled the transaction"
  - name: charge.status.failed_token_cancelled
    description: "Occurs when charge failed due to the cancellation of the associated token"
  - name: charge.status.failed_token_declined
    description: "Occurs when charge failed because the token used for the transaction has been declined"
  - name: charge.status.failed_token_expired
    description: "Occurs when charge failed because of token expiration"
  - name: charge.status.failed_token_not_authorized
    description: "Occurs when charge failed due to unauthorized token"
  - name: charge.status.failed_unauthenticated
    description: "Occurs when charge failed because of authentication"
  - name: charge.status.waiting_for_shopper_action
    description: "Occurs whenever charge is pending completion and await for shopper action"
  - name: charge.status.processing_shopper_action
    description: "Occurs whenever charge shopper action is being processed by Coda"
  - name: charge.status.initiated
    description: "Occurs whenever charge is in the process of being initiated"
  - name: charge.status.initiated_accepted
    description: "Occurs whenever charge initiation is successful and the Provider has accepted initiation"
  - name: charge.status.initiated_not_accepted
    description: "Occurs whenever charge initiation is unsuccessful and the Provider does not accept the initiation"
  - name: charge.status.initiated_failed
    description: "Occurs whenever charge initiation is failed"
  - name: charge.status.not_initiated
    description: "Occurs when charge is not being initiated on Provider end"
  - name: charge.status.authorized
    description: "Occurs whenever charge has been successfully authorized"
  - name: charge.status.succeeded
    description: "Occurs whenever charge is successful"
  - name: charge.status.succeeded_for_subscription
    description: "Occurs whenever charge is successful for subscription"
  - name: token.status.not_initiated
    description: "Occurs when token is not being initiated on Provider end"
  - name: token.status.initiated
    description: "Occurs whenever token is in the process of being initiated"
  - name: token.status.initiated_failed
    description: "Occurs whenever token initiation is failed"
  - name: token.status.waiting_for_shopper_action
    description: "Occurs whenever token is pending completion and await for shopper action"
  - name: token.status.processing_shopper_action
    description: "Occurs whenever token shopper action is being processed by Coda"
  - name: token.status.not_authorized
    description: "Occurs when token failed authorization process"
  - name: token.status.authorized
    description: "Occurs whenever token has been successfully authorized"
  - name: token.status.expired
    description: "Occurs whenever token has been expired"
  - name: token.status.cancelled
    description: "Occurs whenever token has been canceled"
inbound_partner_endpoints:
  note: >-
    The Codashop and Coda Webstore fulfillment contract inverts the direction — Coda calls
    endpoints the publisher hosts. These are documented as JSON-RPC 2.0 methods signed with
    HMAC-SHA256.
  methods:
  - {method: validate, description: Verify that the player/user id exists before purchase}
  - {method: topup, description: Deliver the purchased SKU into the game or app}
  - {method: usersync, description: Synchronise user/player data with Coda}
  - {method: fetch server list, description: Optional — return the server/zone list for the title}
  source: https://docs.coda.co/codashop-and-distribution/integration-guides.md
gaps:
- No AsyncAPI or CloudEvents description of the event surface.
- No published signing secret rotation or replay-window guidance beyond the checksum formulas.
- Checksum uses MD5 rather than an HMAC over the raw body.