Subscribing to the direct debit event webhook allows Monoova to notify you when an inbound direct debit is received on one of your accounts.
\nDirect debits arrive in batches, so you receive the data as a JSON array of transactions, several times a day.
\nEvent name: InboundDirectDebit
\n", "contentType": "application/json", "request": { "pathParameters": [], "headerParameters": [ { "kind": "optional", "name": "Authorisation", "type": "string", "example": "******", "description": "Note. Source account details do not appear by default. Contact Monoova for further information.
\n
Optional. Shared secret that Monoova echoes back on every callback so your endpoint can authenticate the caller. The value is the one you registered on the subscription and is masked in this document. Omitted when no authorisation value was registered. Compare it in constant time and reject the notification with a 401 if it does not match.
", "default": "******", "pattern": "^[\\x20-\\x7E]{1,512}$" }, { "kind": "optional", "name": "Verification-Signature", "type": "string", "example": "e+AFAj2W69rAwbsGn+rSSnFm2ISEblo0MXnx9Qtoh2k5mst1cEEpcrVSzGLjzOPlEL2Ea/iYLbFGzDdxVRTcNLINOhsXM/smimNjBt8sq30FbvSNMjlfDnrZ6FOIkl3E3cu9B+M4OVL8HafPohb67IRNDNyCnCvBM10qHrioiak=", "description": "Optional in the schema, but sent by Monoova on every notification. A base64 encoded cryptographic signature used to verify both the integrity of the message and that Monoova is its source. The hashing method is SHA256 and the public key can be retrieved from /public/v1/certificate/public-key. Verify it before you act on the payload, and reject the notification with a 401 if verification fails.
Optional. Unique identifier for this webhook notification. Store it and treat a repeat of the same value as a redelivery of a notification you have already processed. Pattern: ^\\d{1,19}$.
Batch of inbound direct debit requests drawn against your AutoMatcher accounts. Sent for the InboundDirectDebit event. Source account details are not returned by default — contact Monoova to have them enabled.
Required. Number of direct debit transactions included in this notification. Use it to check you have processed every entry in the array. Pattern: ^\\d{1,10}$.
Required. Sum of the amounts of every direct debit in this notification, in AUD to two decimal places for cents. Pattern: ^\\d{1,13}(\\.\\d{1,2})?$.
Required. One entry per direct debit received in this batch.
", "modelRef": "#/components/schemas/DirectDebitDetails", "customType": "DirectDebitDetails[]", "schema": [] } ], "modelRef": "#/components/schemas/WebhookInboundDirectDebitNotification", "isExpanded": true } ], "formDataParameters": [], "oAuthParameters": [], "cookieParameters": [] }, "responses": [ { "statusCode": "200", "description": "Success. The notification passed validation and your endpoint has accepted responsibility for it. Return this as soon as the payload is persisted — do not wait for downstream processing. Monoova treats any 2xx as a successful delivery and will not retry.
", "jsonExample": "", "isExpanded": true, "schema": [ { "kind": "optional", "type": "object", "example": "{\"status\":\"Received\",\"webhookId\":1234567,\"receivedAt\":\"2026-09-10T14:32:12\"}", "description": "Body your endpoint returns to acknowledge a notification. The body is optional — Monoova treats any 2xx status as a successful delivery — but returning it makes your acknowledgements easier to trace.
", "customType": "WebhookAcknowledgement", "schema": [ { "name": "status", "kind": "optional", "type": "stringRequired. Confirms the notification was accepted for processing. Return the literal value Received.
Optional. Echo of the Webhookid request header, so the acknowledgement can be matched to Monoova's delivery log. Pattern: ^\\d{1,19}$.
Optional. Date and time your endpoint accepted the notification, in ISO 8601 format.
", "example": "2026-09-10T14:32:12", "default": "2026-09-10T14:32:12", "pattern": "^\\d{4}-\\d{2}-\\d{2}([T ]\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,7})?)?$" } ], "modelRef": "#/components/schemas/WebhookAcknowledgement", "isExpanded": true } ] }, { "statusCode": "400", "description": "Bad Request. The notification could not be parsed, or a field failed your validation. Monoova will not retry a notification that is rejected with a 400, so return it only for a genuinely malformed payload — never for a transient fault on your side.
", "jsonExample": "", "isExpanded": true, "schema": [ { "kind": "optional", "type": "object", "example": "{\"status\":\"Rejected\",\"errorCode\":\"INVALID_PAYLOAD\",\"errorMessage\":\"Field 'Amount' is not a valid decimal value.\",\"webhookId\":1234567,\"receivedAt\":\"2026-09-10T14:32:12\"}", "description": "Body your endpoint returns when a notification cannot be accepted. Returned with a 400, 401 or 500 status.
", "customType": "WebhookErrorResponse", "schema": [ { "name": "status", "kind": "optional", "type": "stringRequired. Processing outcome. Return Rejected with a 400, Unauthorised with a 401 and Error with a 500.
Required. Machine-readable code identifying the failure, in upper snake case. Keep the value stable so Monoova support can group repeated failures.
", "example": "INVALID_PAYLOAD", "default": "INVALID_PAYLOAD", "pattern": "^[A-Z][A-Z0-9_]{2,49}$" }, { "name": "errorMessage", "kind": "optional", "type": "string", "description": "Required. Human-readable explanation of the failure. Do not include payment data or credentials in this field.
", "example": "Field 'Amount' is not a valid decimal value.", "default": "Field 'Amount' is not a valid decimal value.", "pattern": "^.{1,500}$" }, { "name": "webhookId", "kind": "optional", "type": "integerOptional. Echo of the Webhookid request header, so the failure can be matched to Monoova's delivery log. Pattern: ^\\d{1,19}$.
Optional. Date and time your endpoint received the notification, in ISO 8601 format.
", "example": "2026-09-10T14:32:12", "default": "2026-09-10T14:32:12", "pattern": "^\\d{4}-\\d{2}-\\d{2}([T ]\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,7})?)?$" } ], "modelRef": "#/components/schemas/WebhookErrorResponse", "isExpanded": true } ] }, { "statusCode": "401", "description": "Unauthorised. The Authorisation header was missing or did not match the value registered on the subscription, or the Verification-Signature header failed SHA256 verification against the Monoova public key. Return this without processing the payload.
Body your endpoint returns when a notification cannot be accepted. Returned with a 400, 401 or 500 status.
", "customType": "WebhookErrorResponse", "schema": [ { "name": "status", "kind": "optional", "type": "stringRequired. Processing outcome. Return Rejected with a 400, Unauthorised with a 401 and Error with a 500.
Required. Machine-readable code identifying the failure, in upper snake case. Keep the value stable so Monoova support can group repeated failures.
", "example": "INVALID_PAYLOAD", "default": "INVALID_PAYLOAD", "pattern": "^[A-Z][A-Z0-9_]{2,49}$" }, { "name": "errorMessage", "kind": "optional", "type": "string", "description": "Required. Human-readable explanation of the failure. Do not include payment data or credentials in this field.
", "example": "Field 'Amount' is not a valid decimal value.", "default": "Field 'Amount' is not a valid decimal value.", "pattern": "^.{1,500}$" }, { "name": "webhookId", "kind": "optional", "type": "integerOptional. Echo of the Webhookid request header, so the failure can be matched to Monoova's delivery log. Pattern: ^\\d{1,19}$.
Optional. Date and time your endpoint received the notification, in ISO 8601 format.
", "example": "2026-09-10T14:32:12", "default": "2026-09-10T14:32:12", "pattern": "^\\d{4}-\\d{2}-\\d{2}([T ]\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,7})?)?$" } ], "modelRef": "#/components/schemas/WebhookErrorResponse", "isExpanded": true } ] }, { "statusCode": "500", "description": "Internal Server Error. Your endpoint accepted the notification but could not process it because of a fault on your side. Monoova retries a notification that fails with a 5xx, so return this — rather than a 400 — whenever the failure is transient and a redelivery could succeed.
", "jsonExample": "", "isExpanded": true, "schema": [ { "kind": "optional", "type": "object", "example": "{\"status\":\"Error\",\"errorCode\":\"DOWNSTREAM_UNAVAILABLE\",\"errorMessage\":\"Ledger service unavailable; retry delivery.\",\"webhookId\":1234567,\"receivedAt\":\"2026-09-10T14:32:12\"}", "description": "Body your endpoint returns when a notification cannot be accepted. Returned with a 400, 401 or 500 status.
", "customType": "WebhookErrorResponse", "schema": [ { "name": "status", "kind": "optional", "type": "stringRequired. Processing outcome. Return Rejected with a 400, Unauthorised with a 401 and Error with a 500.
Required. Machine-readable code identifying the failure, in upper snake case. Keep the value stable so Monoova support can group repeated failures.
", "example": "INVALID_PAYLOAD", "default": "INVALID_PAYLOAD", "pattern": "^[A-Z][A-Z0-9_]{2,49}$" }, { "name": "errorMessage", "kind": "optional", "type": "string", "description": "Required. Human-readable explanation of the failure. Do not include payment data or credentials in this field.
", "example": "Field 'Amount' is not a valid decimal value.", "default": "Field 'Amount' is not a valid decimal value.", "pattern": "^.{1,500}$" }, { "name": "webhookId", "kind": "optional", "type": "integerOptional. Echo of the Webhookid request header, so the failure can be matched to Monoova's delivery log. Pattern: ^\\d{1,19}$.
Optional. Date and time your endpoint received the notification, in ISO 8601 format.
", "example": "2026-09-10T14:32:12", "default": "2026-09-10T14:32:12", "pattern": "^\\d{4}-\\d{2}-\\d{2}([T ]\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,7})?)?$" } ], "modelRef": "#/components/schemas/WebhookErrorResponse", "isExpanded": true } ] } ], "hasXCodeSamples": false, "examples": { "languages": [ { "id": "sv31cXRgbpXDZRKw08z4d", "language": "curl", "label": "cURL", "code": "curl --request POST \\\n --url https://api.mpay.com.au/INBOUNDDIRECTDEBITEVENTWEBHOOK_TARGET_URL \\\n --header 'accept: application/json' \\\n --header 'content-type: application/json' \\\n --header 'authorisation: ******' \\\n --header 'verification-signature: e+AFAj2W69rAwbsGn+rSSnFm2ISEblo0MXnx9Qtoh2k5mst1cEEpcrVSzGLjzOPlEL2Ea/iYLbFGzDdxVRTcNLINOhsXM/smimNjBt8sq30FbvSNMjlfDnrZ6FOIkl3E3cu9B+M4OVL8HafPohb67IRNDNyCnCvBM10qHrioiak=' \\\n --header 'webhookid: 1234567' \\\n --data '{\n \"TotalCount\": 3,\n \"TotalAmount\": 452.75\n }'" }, { "id": "f22tjfIF45sbvT1gDsIOg", "language": "javascript", "label": "javascript", "code": "var myHeaders = new Headers();\nmyHeaders.append(\"accept\", \"application/json\");\nmyHeaders.append(\"content-type\", \"application/json\");\nmyHeaders.append(\"authorisation\", \"******\");\nmyHeaders.append(\"verification-signature\", \"e+AFAj2W69rAwbsGn+rSSnFm2ISEblo0MXnx9Qtoh2k5mst1cEEpcrVSzGLjzOPlEL2Ea/iYLbFGzDdxVRTcNLINOhsXM/smimNjBt8sq30FbvSNMjlfDnrZ6FOIkl3E3cu9B+M4OVL8HafPohb67IRNDNyCnCvBM10qHrioiak=\");\nmyHeaders.append(\"webhookid\", \"1234567\");\n\nvar raw = JSON.stringify({\n \"TotalCount\": 3,\n \"TotalAmount\": 452.75\n});\n\nvar requestOptions = {\n method: 'POST',\n headers: myHeaders,\n body: raw,\n redirect: 'follow'\n};\n\nfetch(\"https://api.mpay.com.au/INBOUNDDIRECTDEBITEVENTWEBHOOK_TARGET_URL\", requestOptions)\n .then(response => response.text())\n .then(result => console.log(result))\n .catch(error => console.log('error', error));" }, { "id": "seabt8B7DqT_H4fR9Tw9A", "language": "ruby", "label": "Ruby", "code": "require \"uri\"\nrequire \"json\"\nrequire \"net/http\"\n\nurl = URI(\"https://api.mpay.com.au/INBOUNDDIRECTDEBITEVENTWEBHOOK_TARGET_URL\")\n\nhttps = Net::HTTP.new(url.host, url.port)\nhttps.use_ssl = true\n\nrequest = Net::HTTP::Post.new(url)\nrequest[\"accept\"] = \"application/json\"\nrequest[\"content-type\"] = \"application/json\"\nrequest[\"authorisation\"] = \"******\"\nrequest[\"verification-signature\"] = \"e+AFAj2W69rAwbsGn+rSSnFm2ISEblo0MXnx9Qtoh2k5mst1cEEpcrVSzGLjzOPlEL2Ea/iYLbFGzDdxVRTcNLINOhsXM/smimNjBt8sq30FbvSNMjlfDnrZ6FOIkl3E3cu9B+M4OVL8HafPohb67IRNDNyCnCvBM10qHrioiak=\"\nrequest[\"webhookid\"] = \"1234567\"\nrequest.body = JSON.dump({\n \"TotalCount\": 3,\n \"TotalAmount\": 452.75\n})\n\nresponse = https.request(request)\nputs response.read_body\n" }, { "id": "ltyXmwp7mP17uhOZ0GiWl", "language": "python", "label": "Python", "code": "import requests\nimport json\n\nurl = \"https://api.mpay.com.au/INBOUNDDIRECTDEBITEVENTWEBHOOK_TARGET_URL\"\n\npayload = json.dumps({\n \"TotalCount\": 3,\n \"TotalAmount\": 452.75\n})\nheaders = {\n 'accept': 'application/json',\n 'content-type': 'application/json',\n 'authorisation': '******',\n 'verification-signature': 'e+AFAj2W69rAwbsGn+rSSnFm2ISEblo0MXnx9Qtoh2k5mst1cEEpcrVSzGLjzOPlEL2Ea/iYLbFGzDdxVRTcNLINOhsXM/smimNjBt8sq30FbvSNMjlfDnrZ6FOIkl3E3cu9B+M4OVL8HafPohb67IRNDNyCnCvBM10qHrioiak=',\n 'webhookid': '1234567'\n}\n\nresponse = requests.request(\"POST\", url, headers=headers, data=payload)\n\nprint(response.text)\n" } ], "selectedLanguageId": "sv31cXRgbpXDZRKw08z4d" }, "results": { "languages": [ { "id": "P6KcOFDGQauJYQl2GiHSL", "language": "200", "code": "// Success. The notification passed validation and your endpoint has accepted responsibility for it. Return this as soon as the payload is persisted — do not wait for downstream processing. Monoova treats any 2xx as a successful delivery and will not retry.\n{\n \"status\": \"Received\",\n \"webhookId\": 1234567,\n \"receivedAt\": \"2026-09-10T14:32:12\"\n}" }, { "id": "T5u4Pc8scBLNd77GZj3T_", "language": "400", "code": "// Bad Request. The notification could not be parsed, or a field failed your validation. Monoova will not retry a notification that is rejected with a 400, so return it only for a genuinely malformed payload — never for a transient fault on your side.\n{\n \"status\": \"Rejected\",\n \"errorCode\": \"INVALID_PAYLOAD\",\n \"errorMessage\": \"Field 'Amount' is not a valid decimal value.\",\n \"webhookId\": 1234567,\n \"receivedAt\": \"2026-09-10T14:32:12\"\n}" }, { "id": "mxwQnUJ2MphCc6Xbd0VZg", "language": "401", "code": "// Unauthorised. The Authorisation header was missing or did not match the value registered on the subscription, or the Verification-Signature header failed SHA256 verification against the Monoova public key. Return this without processing the payload.\n{\n \"status\": \"Rejected\",\n \"errorCode\": \"INVALID_PAYLOAD\",\n \"errorMessage\": \"Field 'Amount' is not a valid decimal value.\",\n \"webhookId\": 1234567,\n \"receivedAt\": \"2026-09-10T14:32:12\"\n}" }, { "id": "WTFjzLUrtmhGQT_7W3I6x", "language": "500", "code": "// Internal Server Error. Your endpoint accepted the notification but could not process it because of a fault on your side. Monoova retries a notification that fails with a 5xx, so return this — rather than a 400 — whenever the failure is transient and a redelivery could succeed.\n{\n \"status\": \"Rejected\",\n \"errorCode\": \"INVALID_PAYLOAD\",\n \"errorMessage\": \"Field 'Amount' is not a valid decimal value.\",\n \"webhookId\": 1234567,\n \"receivedAt\": \"2026-09-10T14:32:12\"\n}" } ], "selectedLanguageId": "P6KcOFDGQauJYQl2GiHSL" } }, "children": [ { "text": "" } ] }