Webhook

When notify_url is set on create/confirm, the platform POSTs JSON to that URL after the order reaches a terminal status. Empty means no webhook. A webhook is a notification, not the source of truth — treat query APIs as final. Deliveries may be delayed or duplicated; handle them idempotently.

Delivery rules are on this page. Event payloads are on the event pages.

Events

Event	Trigger status	Payload
Exchange order	FINISHED / FAILED / CANCELLED	Same as Query Exchange Order data
Withdraw order	FINISHED / FAILED / CANCELLED	Same as Query Withdraw Order data

Delivery rules

• Method: POST, Content-Type: application/json
• Path: merchant notify_url (path and query used as-is)
• Body: no {status,msg,data} envelope
• Success: HTTP 200 (response body is ignored)
• Non-200, timeout (3 seconds), or connection failure is retried. At most 8 attempts (including the first), about 0 / 5s / 15s / 1min / 5min / 15min / 30min / 1h apart
• Treat trade_sn / order_no as idempotent

Request headers

Same algorithm as Request Signing. The platform signs with the platform private key; verify with the platform public key from the merchant console (plat_public_key).

Content-Type: application/json
X-Merchant-Id: <merchant_id>
X-Timestamp: 1710000000
X-Nonce: a9f3c1d47e8b9a2c
Digest: SHA-256=<Base64(SHA256(body))>
Authorization: Signature keyId="<merchant_id>",alg="ES256",headers="(request-target) x-timestamp x-nonce digest",signature="<Base64>"

Field	Type	Description
X-Merchant-Id	string	Matches Authorization.keyId
X-Timestamp	int64	Unix timestamp in seconds
X-Nonce	string	Random string
Digest	string	SHA-256= + Base64(SHA256(raw body))
Authorization	string	Signature keyId=...,alg="ES256",headers="...",signature="..."

The Canonical String (request-target) is post plus the notify_url path (including query).

Verification: check Digest against the raw body, rebuild the Canonical String, and verify Authorization.signature with the platform public key. Do not process the event before verification succeeds.