Callback Delivery

When you’ve matched a receipt from your collection to an OpenCard transaction, POST it here:

POST https://api.opencard.io/api/v1/service/marcet/callback/{referenceId}

{referenceId} = OpenCard transaction reference from the match request.

Required headers

Header	Value
`X-Event`	`CallbackRequestResolved` or `CallbackRequestDeleted`
`X-CallbackRequest-Id`	Callback request ID from OpenCard
`X-Data-Signature`	`HMAC-SHA256(raw_body, client_secret)`

import hmac, hashlib

signature = hmac.new(
    client_secret.encode(),
    request_body_bytes,
    hashlib.sha256
).hexdigest()

const crypto = require('crypto');
const sig = crypto.createHmac('sha256', clientSecret)
  .update(rawBody)
  .digest('hex');

Must match X-Data-Signature header exactly. Raw body bytes, not re-serialized JSON.

Content type depends on callback type configured for the request:

OpenCard extracts:

Duplicate CallbackRequestResolved for already-resolved requests → 200 (idempotent, logged as warning).