{
  "apikey": "YTrarsfn7309Ys8075",
  "country": "Republic of Congo",
  "carrier": "Airtel CG",
  "number": "061234567",
  "amount": 40
}

{
  "success": true,
  "message": "Request accepted, processing in progress",
  "amount": 40,
  "fee_charged": 2,
  "total": 42,
  "remaining_balance": 12408
  "request_id": "A reference Id for this request"
}

{
  "success": false,
  "message": "Insufficient fund/Balance."
}

{
  "apikey": "YTrarsfn7309Ys8075",
  "country": "Republic of Congo",
  "carrier": "Airtel CG",
  "number": "061234567",
  "amount": 70
}

{
  "success": true,
  "message": "Request accepted, processing in progress",
  "amount": 70,
  "fee_charged": 5,
  "total": 75,
  "remaining_balance": 5238
  "request_id": "A reference Id for this request"
}

{
   "event": "transaction_updated",
   "created_at":  1787001600,
   "data": {
   "request_id": "987654321",
   "country": "Germany",
   "carrier": "Vodacom",
   "number": "255700000000",
   "amount": 25000,
   "fee_charged": 500,
   "total": 25500,
   "status": "Success",
   "timestamp_ms": "1787001595000",
   "transaction_sms": "Transaction SMS"
  }
}

<?php
// Enforce strict JSON communication boundaries
header("Content-Type: application/json; charset=utf-8");

// 1. Extract the secure header string sent by Digitwave Services
$incomingSignature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';

// 2. Read the raw request body stream text before any decoding
$rawPayload = file_get_contents('php://input');

// 3. Define your shared secret token safely out of your environment variables
$myWebhookSecret = "REPLACE_THIS_WITH_YOUR_WEBHOOK_SECRET_KEY_FROM_DIGITWAVE_DASHBOARD"; 

if (empty($incomingSignature) || empty($rawPayload)) {
    http_response_code(400);
    echo json_encode(["error" => "Bad Request: Missing payload or signature data structures."]);
    exit;
}

// 4. Compute your local signature match code using HMAC-SHA256
$computedSignature = hash_hmac('sha256', $rawPayload, $myWebhookSecret);

// 5. Securely verify signatures using a timing-attack safe function
if (!hash_equals($computedSignature, $incomingSignature)) {
    http_response_code(401); // Authentication failed
    echo json_encode(["error" => "Unauthorized: Webhook signature verification failed."]);
    exit;
}

// 6. Signatures match perfectly! Process data safely inside your business logic
$payload = json_decode($rawPayload, true);
$transactionStatus = $payload['data']['status'];
$requestId         = $payload['data']['request_id'];

// TODO: Update your internal database logs matching $requestId with the new $transactionStatus

// 7. Always acknowledge receipt within 5 seconds with a clean 200 OK code
http_response_code(200);
echo json_encode(["status" => "acknowledged", "received_at" => time()]);
exit;
?>

get_request?apikey=xg7749CT83By05cM76&request_id=10v42

{
  "success": true,
  "data": {
    {
    "apikey": 65GE59hyr453,
    "request_id": 10W6v42,
    "country": Republic of Congo,
    "carrier": Airtel CG,
    "number": 061234567,
    "amount": 55,
    "fee_charged": 0,
    "total": 55,
    "status": "Success",
    "timestamp_ms": 1774983050123 // Epoch milliseconds.
    "transaction_sms": Transaction Message,
  }  
 }
}

get_requests?apikey=xg7749CT83By05cM76&last_request_id=65GE59hyr453&order=DESC&limit=50

{
  "success": true,
  "total_records": 2,
  "data": [
    {
    "apikey": 65GE59hyr453,
    "request_id": 10v42,
    "country": Republic of Congo,
    "carrier": Airtel CG,
    "number": 061234567,
    "amount": 55,
    "fee_charged": 0,
    "total": 55,
    "status": "Success",
    "timestamp_ms": 1774983050123 // Epoch milliseconds.
    "transaction_sms": Transaction Message,
  },
    {
    "apikey": 65GE59hyr453,
    "request_id": 10v457EW2,
    "country": Republic of Congo,
    "carrier": Airtel CG,
    "number": 061234567,
    "amount": 55,
    "fee_charged": 0,
    "total": 55,
    "status": "Success",
    "timestamp_ms": 1774983057963 // Epoch milliseconds.
    "transaction_sms": Transaction Message,
  }
  ]
}