Webhooks

Artos sends webhook notifications to your registered endpoints when payment events occur. Configure webhook URLs from your Dashboard → Webhooks.

Events

Event	Description
`payment.success`	Payment completed successfully
`payment.failed`	Payment failed or was rejected
`payment.expired`	Pending payment passed its expiredAt time

Payload

Artos sends a POST request with the following JSON body to your webhook URL.

idstring

Unique event ID. Retries of the same event reuse this ID — use it for idempotency.

eventstring

payment.success, payment.failed, or payment.expired.

createdAtstring

Time the event was created (ISO 8601).

data.transactionIdstring

Artos transaction ID.

data.merchantOrderIdstring

Your own merchantOrderId if the payment was created via the API; otherwise the internal Artos order ID.

data.amountinteger

Payment amount in IDR.

data.statusstring

Transaction status: paid, failed, or expired.

data.referencestring

Payment provider (Duitku) reference.

payment.success

{
  "id": "3b241101-e2bb-4255-8caf-4136c566a962",
  "event": "payment.success",
  "createdAt": "2025-01-01T00:05:00.000Z",
  "data": {
    "transactionId": "550e8400-e29b-41d4-a716-446655440000",
    "merchantOrderId": "ORDER-001",
    "amount": 50000,
    "status": "paid",
    "reference": "DS1234525ABCDEFGH"
  }
}

payment.failed

{
  "id": "9a7c1f2e-5d4b-4e8a-b3c6-0f1e2d3c4b5a",
  "event": "payment.failed",
  "createdAt": "2025-01-01T00:05:00.000Z",
  "data": {
    "transactionId": "550e8400-e29b-41d4-a716-446655440000",
    "merchantOrderId": "ORDER-001",
    "amount": 50000,
    "status": "failed",
    "reference": "DS1234525ABCDEFGH"
  }
}

payment.expired

{
  "id": "e4d3c2b1-a0f9-4e8d-9c7b-6a5f4e3d2c1b",
  "event": "payment.expired",
  "createdAt": "2025-01-01T01:00:00.000Z",
  "data": {
    "transactionId": "550e8400-e29b-41d4-a716-446655440000",
    "merchantOrderId": "ORDER-001",
    "amount": 50000,
    "status": "expired",
    "reference": "DS1234525ABCDEFGH"
  }
}

Headers

Each webhook request includes the following headers.

Content-Typeheader

Always application/json

X-Artos-Signatureheader

Hex-encoded HMAC-SHA256 of the raw request body, signed with your webhook secret. See Verifying Signatures.

X-Artos-Eventheader

The event type, e.g. payment.success.

X-Artos-Event-Idheader

The event id (same as in the body).

Delivery & Retry

Respond with any 2xx status within 10 seconds. Redirects are not followed.
Timeouts, network errors, 5xx, 408 and 429 responses are retried automatically with backoff of 1m, 5m, 30m, 2h, and 6h (at most 6 attempts in total). Any other non-2xx response (e.g. 400, 401, 404, or a redirect) is treated as a final rejection and is not retried automatically.
You can also retry a delivery manually from Webhook Logs.
Each event is sent at most once per status change — duplicate provider callbacks do not trigger a new event. Retries resend the same event id, so always deduplicate by id.

Endpoint Requirements