Tax Genius · India
Signed API Webhooks & Event Verification
Integrate HMAC-SHA256-signed payment and application status webhooks, verify signatures and design reliable event consumers.
Webhooks and asynchronous events
Consume signed Tax Genius notifications for payment completion and compliance application changes without exposing your private vendor credentials.
Documented event types
The supplied API guide describes payment.successful and application.status_changed events. The event body includes a timestamp and data with tracking_id, application identifiers and event-specific fields.
- payment.successful — payment confirmation data.
- application.status_changed — status transitions, potentially including acknowledgement_url.
- Additional event names and retry policies must not be assumed until the deployed backend contract is reviewed.
Event delivery headers
Register a backend HTTPS callback under the approved vendor relationship. The signature header carries an HMAC-SHA256 digest.
Verify the raw request-body signature
The source defines the signature as HMAC-SHA256 over the original raw JSON body, keyed with the shared API secret. Do not re-serialize parsed JSON before verification. Use constant-time digest comparison.
Reliable event processing
- Authenticate the webhook before JSON parsing or any state transition.
- Queue accepted events, apply duplicate-event protection and return an appropriate HTTP status.
- Reconcile with GET /applications/{tracking_id}/status when event order is uncertain.
- Do not download acknowledgement URLs before authorised access checks.
The uploaded guide does not specify retry delays, message IDs, replay windows or maximum delivery attempts. Those are backend-contract questions, not promised behaviour.