Subscribing to the NPP payment status event webhook allows Monoova to notify you when the status of a pending NPP payment is updated, so you do not need to poll for updates.
\nEvent name: NppPaymentStatus
\n", "contentType": "application/json", "request": { "pathParameters": [], "headerParameters": [ { "kind": "optional", "name": "Authorisation", "type": "string", "example": "******", "description": "Note. The
\nPendingstatus is not reported by this webhook.
Optional. Shared secret that Monoova echoes back on every callback so your endpoint can authenticate the caller. The value is the one you registered on the subscription and is masked in this document. Omitted when no authorisation value was registered. Compare it in constant time and reject the notification with a 401 if it does not match.
", "default": "******", "pattern": "^[\\x20-\\x7E]{1,512}$" }, { "kind": "optional", "name": "Verification-Signature", "type": "string", "example": "e+AFAj2W69rAwbsGn+rSSnFm2ISEblo0MXnx9Qtoh2k5mst1cEEpcrVSzGLjzOPlEL2Ea/iYLbFGzDdxVRTcNLINOhsXM/smimNjBt8sq30FbvSNMjlfDnrZ6FOIkl3E3cu9B+M4OVL8HafPohb67IRNDNyCnCvBM10qHrioiak=", "description": "Optional in the schema, but sent by Monoova on every notification. A base64 encoded cryptographic signature used to verify both the integrity of the message and that Monoova is its source. The hashing method is SHA256 and the public key can be retrieved from /public/v1/certificate/public-key. Verify it before you act on the payload, and reject the notification with a 401 if verification fails.
Optional. Unique identifier for this webhook notification. Store it and treat a repeat of the same value as a redelivery of a notification you have already processed. Pattern: ^\\d{1,19}$.
Payload sent when the status of a pending outbound NPP payment changes. Sent for the NppPaymentStatus event. The Pending status itself is never reported by this webhook.
Required. Monoova transaction identifier of the NPP payment whose status changed.
", "example": "884231703", "default": "884231703", "pattern": "^\\d{1,19}$" }, { "name": "UniqueReference", "kind": "optional", "type": "string", "description": "Required. Your own unique reference, supplied when the payment was submitted. Use it to match the notification to your record.
", "example": "ACME-PAY-000123", "default": "ACME-PAY-000123", "pattern": "^.{1,64}$" }, { "name": "TransactionDate", "kind": "optional", "type": "string", "description": "Required. Date the payment was submitted, in Sydney local time (AEST/AEDT).
", "example": "2026-09-10", "default": "2026-09-10", "pattern": "^\\d{4}-\\d{2}-\\d{2}([T ]\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,7})?)?$" }, { "name": "Amount", "kind": "optional", "type": "string", "description": "Required. Value of the payment in AUD, expressed as a decimal string with exactly two decimal places for cents. Never negative.
", "example": "150.00", "default": "150.00", "pattern": "^\\d{1,13}\\.\\d{2}$" }, { "name": "Status", "kind": "optional", "type": "string", "description": "Required. Current status of the NPP payment. See the Monoova transaction status reference for the full list of values; Pending is never sent by this webhook.
Required. Destination bank account number the payment was sent to.
", "example": "12345678", "default": "12345678", "pattern": "^\\d{5,10}$" }, { "name": "AccountName", "kind": "optional", "type": "string", "description": "Optional. Account name held against the destination account.
", "example": "John A Smith", "default": "John A Smith", "pattern": "^.{0,140}$" }, { "name": "Bsb", "kind": "optional", "type": "string", "description": "Required. BSB of the destination account. Six digits, with or without the conventional hyphen after the third digit.
", "example": "802-985", "default": "802-985", "pattern": "^\\d{3}-?\\d{3}$" }, { "name": "PayId", "kind": "optional", "type": "string", "description": "Conditional. Returned when the payment was addressed to a PayID instead of a BSB and account number.
", "example": "john.smith@example.com", "default": "john.smith@example.com", "pattern": "^.{1,256}$" }, { "name": "PayIdType", "kind": "optional", "type": "stringConditional. Returned alongside PayId. Identifies which type of PayID the payment was addressed to.
Optional. Osko end-to-end identifier supplied by the payer and carried unchanged across the NPP. Echo it back on any related payment so the two legs can be matched.
", "example": "E2E-2026-0000123", "default": "E2E-2026-0000123", "pattern": "^[A-Za-z0-9\\/+?:().,'\\s-]{0,35}$" }, { "name": "LodgementReference", "kind": "optional", "type": "string", "description": "Optional. Reference shown on the payee's bank statement, as supplied when the payment was submitted. Truncated to 18 characters by the clearing system.
", "example": "ACME INV 10023", "default": "ACME INV 10023", "pattern": "^.{0,18}$" }, { "name": "RemitterName", "kind": "optional", "type": "string", "description": "Optional. Remitter name shown on the payee's bank statement.
", "example": "ACME PTY LTD", "default": "ACME PTY LTD", "pattern": "^.{0,140}$" }, { "name": "RejectionDateTime", "kind": "optional", "type": "string", "description": "Conditional. Returned only when the payment was rejected or returned. Date and time the rejection was recorded, in Sydney local time (AEST/AEDT). Absent on a successful payment.
", "example": "2026-09-10T14:35:02", "default": "2026-09-10T14:35:02", "pattern": "^\\d{4}-\\d{2}-\\d{2}([T ]\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,7})?)?$" }, { "name": "RejectionReasonDescription", "kind": "optional", "type": "string", "description": "Conditional. Returned alongside RejectionDateTime. Plain-language reason the payment was rejected or returned by the payee's financial institution.
Conditional. Returned alongside RejectionDateTime. Monoova transaction identifier of the reversing entry raised against the original payment.
Success. The notification passed validation and your endpoint has accepted responsibility for it. Return this as soon as the payload is persisted — do not wait for downstream processing. Monoova treats any 2xx as a successful delivery and will not retry.
", "jsonExample": "", "isExpanded": true, "schema": [ { "kind": "optional", "type": "object", "example": "{\"status\":\"Received\",\"webhookId\":1234567,\"receivedAt\":\"2026-09-10T14:32:12\"}", "description": "Body your endpoint returns to acknowledge a notification. The body is optional — Monoova treats any 2xx status as a successful delivery — but returning it makes your acknowledgements easier to trace.
", "customType": "WebhookAcknowledgement", "schema": [ { "name": "status", "kind": "optional", "type": "stringRequired. Confirms the notification was accepted for processing. Return the literal value Received.
Optional. Echo of the Webhookid request header, so the acknowledgement can be matched to Monoova's delivery log. Pattern: ^\\d{1,19}$.
Optional. Date and time your endpoint accepted the notification, in ISO 8601 format.
", "example": "2026-09-10T14:32:12", "default": "2026-09-10T14:32:12", "pattern": "^\\d{4}-\\d{2}-\\d{2}([T ]\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,7})?)?$" } ], "modelRef": "#/components/schemas/WebhookAcknowledgement", "isExpanded": true } ] }, { "statusCode": "400", "description": "Bad Request. The notification could not be parsed, or a field failed your validation. Monoova will not retry a notification that is rejected with a 400, so return it only for a genuinely malformed payload — never for a transient fault on your side.
", "jsonExample": "", "isExpanded": true, "schema": [ { "kind": "optional", "type": "object", "example": "{\"status\":\"Rejected\",\"errorCode\":\"INVALID_PAYLOAD\",\"errorMessage\":\"Field 'Amount' is not a valid decimal value.\",\"webhookId\":1234567,\"receivedAt\":\"2026-09-10T14:32:12\"}", "description": "Body your endpoint returns when a notification cannot be accepted. Returned with a 400, 401 or 500 status.
", "customType": "WebhookErrorResponse", "schema": [ { "name": "status", "kind": "optional", "type": "stringRequired. Processing outcome. Return Rejected with a 400, Unauthorised with a 401 and Error with a 500.
Required. Machine-readable code identifying the failure, in upper snake case. Keep the value stable so Monoova support can group repeated failures.
", "example": "INVALID_PAYLOAD", "default": "INVALID_PAYLOAD", "pattern": "^[A-Z][A-Z0-9_]{2,49}$" }, { "name": "errorMessage", "kind": "optional", "type": "string", "description": "Required. Human-readable explanation of the failure. Do not include payment data or credentials in this field.
", "example": "Field 'Amount' is not a valid decimal value.", "default": "Field 'Amount' is not a valid decimal value.", "pattern": "^.{1,500}$" }, { "name": "webhookId", "kind": "optional", "type": "integerOptional. Echo of the Webhookid request header, so the failure can be matched to Monoova's delivery log. Pattern: ^\\d{1,19}$.
Optional. Date and time your endpoint received the notification, in ISO 8601 format.
", "example": "2026-09-10T14:32:12", "default": "2026-09-10T14:32:12", "pattern": "^\\d{4}-\\d{2}-\\d{2}([T ]\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,7})?)?$" } ], "modelRef": "#/components/schemas/WebhookErrorResponse", "isExpanded": true } ] }, { "statusCode": "401", "description": "Unauthorised. The Authorisation header was missing or did not match the value registered on the subscription, or the Verification-Signature header failed SHA256 verification against the Monoova public key. Return this without processing the payload.
Body your endpoint returns when a notification cannot be accepted. Returned with a 400, 401 or 500 status.
", "customType": "WebhookErrorResponse", "schema": [ { "name": "status", "kind": "optional", "type": "stringRequired. Processing outcome. Return Rejected with a 400, Unauthorised with a 401 and Error with a 500.
Required. Machine-readable code identifying the failure, in upper snake case. Keep the value stable so Monoova support can group repeated failures.
", "example": "INVALID_PAYLOAD", "default": "INVALID_PAYLOAD", "pattern": "^[A-Z][A-Z0-9_]{2,49}$" }, { "name": "errorMessage", "kind": "optional", "type": "string", "description": "Required. Human-readable explanation of the failure. Do not include payment data or credentials in this field.
", "example": "Field 'Amount' is not a valid decimal value.", "default": "Field 'Amount' is not a valid decimal value.", "pattern": "^.{1,500}$" }, { "name": "webhookId", "kind": "optional", "type": "integerOptional. Echo of the Webhookid request header, so the failure can be matched to Monoova's delivery log. Pattern: ^\\d{1,19}$.
Optional. Date and time your endpoint received the notification, in ISO 8601 format.
", "example": "2026-09-10T14:32:12", "default": "2026-09-10T14:32:12", "pattern": "^\\d{4}-\\d{2}-\\d{2}([T ]\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,7})?)?$" } ], "modelRef": "#/components/schemas/WebhookErrorResponse", "isExpanded": true } ] }, { "statusCode": "500", "description": "Internal Server Error. Your endpoint accepted the notification but could not process it because of a fault on your side. Monoova retries a notification that fails with a 5xx, so return this — rather than a 400 — whenever the failure is transient and a redelivery could succeed.
", "jsonExample": "", "isExpanded": true, "schema": [ { "kind": "optional", "type": "object", "example": "{\"status\":\"Error\",\"errorCode\":\"DOWNSTREAM_UNAVAILABLE\",\"errorMessage\":\"Ledger service unavailable; retry delivery.\",\"webhookId\":1234567,\"receivedAt\":\"2026-09-10T14:32:12\"}", "description": "Body your endpoint returns when a notification cannot be accepted. Returned with a 400, 401 or 500 status.
", "customType": "WebhookErrorResponse", "schema": [ { "name": "status", "kind": "optional", "type": "stringRequired. Processing outcome. Return Rejected with a 400, Unauthorised with a 401 and Error with a 500.
Required. Machine-readable code identifying the failure, in upper snake case. Keep the value stable so Monoova support can group repeated failures.
", "example": "INVALID_PAYLOAD", "default": "INVALID_PAYLOAD", "pattern": "^[A-Z][A-Z0-9_]{2,49}$" }, { "name": "errorMessage", "kind": "optional", "type": "string", "description": "Required. Human-readable explanation of the failure. Do not include payment data or credentials in this field.
", "example": "Field 'Amount' is not a valid decimal value.", "default": "Field 'Amount' is not a valid decimal value.", "pattern": "^.{1,500}$" }, { "name": "webhookId", "kind": "optional", "type": "integerOptional. Echo of the Webhookid request header, so the failure can be matched to Monoova's delivery log. Pattern: ^\\d{1,19}$.
Optional. Date and time your endpoint received the notification, in ISO 8601 format.
", "example": "2026-09-10T14:32:12", "default": "2026-09-10T14:32:12", "pattern": "^\\d{4}-\\d{2}-\\d{2}([T ]\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,7})?)?$" } ], "modelRef": "#/components/schemas/WebhookErrorResponse", "isExpanded": true } ] } ], "hasXCodeSamples": false, "examples": { "languages": [ { "id": "JRM_waDWFUd7KsRbR1Zyg", "language": "curl", "label": "cURL", "code": "curl --request POST \\\n --url https://api.mpay.com.au/NPPPAYMENTSTATUSEVENTWEBHOOK_TARGET_URL \\\n --header 'accept: application/json' \\\n --header 'content-type: application/json' \\\n --header 'authorisation: ******' \\\n --header 'verification-signature: e+AFAj2W69rAwbsGn+rSSnFm2ISEblo0MXnx9Qtoh2k5mst1cEEpcrVSzGLjzOPlEL2Ea/iYLbFGzDdxVRTcNLINOhsXM/smimNjBt8sq30FbvSNMjlfDnrZ6FOIkl3E3cu9B+M4OVL8HafPohb67IRNDNyCnCvBM10qHrioiak=' \\\n --header 'webhookid: 1234567' \\\n --data-raw '{\n \"TransactionId\": \"884231703\",\n \"UniqueReference\": \"ACME-PAY-000123\",\n \"TransactionDate\": \"2026-09-10\",\n \"Amount\": \"150.00\",\n \"Status\": \"Successful\",\n \"AccountNumber\": \"12345678\",\n \"AccountName\": \"John A Smith\",\n \"Bsb\": \"802-985\",\n \"PayId\": \"john.smith@example.com\",\n \"PayIdType\": \"Email\",\n \"EndToEndId\": \"E2E-2026-0000123\",\n \"LodgementReference\": \"ACME INV 10023\",\n \"RemitterName\": \"ACME PTY LTD\",\n \"RejectionDateTime\": \"2026-09-10T14:35:02\",\n \"RejectionReasonDescription\": \"Account closed\",\n \"RejectionTransactionId\": \"884231704\"\n }'" }, { "id": "6JkxsiD23mSvHz7izUe-n", "language": "javascript", "label": "javascript", "code": "var myHeaders = new Headers();\nmyHeaders.append(\"accept\", \"application/json\");\nmyHeaders.append(\"content-type\", \"application/json\");\nmyHeaders.append(\"authorisation\", \"******\");\nmyHeaders.append(\"verification-signature\", \"e+AFAj2W69rAwbsGn+rSSnFm2ISEblo0MXnx9Qtoh2k5mst1cEEpcrVSzGLjzOPlEL2Ea/iYLbFGzDdxVRTcNLINOhsXM/smimNjBt8sq30FbvSNMjlfDnrZ6FOIkl3E3cu9B+M4OVL8HafPohb67IRNDNyCnCvBM10qHrioiak=\");\nmyHeaders.append(\"webhookid\", \"1234567\");\n\nvar raw = JSON.stringify({\n \"TransactionId\": \"884231703\",\n \"UniqueReference\": \"ACME-PAY-000123\",\n \"TransactionDate\": \"2026-09-10\",\n \"Amount\": \"150.00\",\n \"Status\": \"Successful\",\n \"AccountNumber\": \"12345678\",\n \"AccountName\": \"John A Smith\",\n \"Bsb\": \"802-985\",\n \"PayId\": \"john.smith@example.com\",\n \"PayIdType\": \"Email\",\n \"EndToEndId\": \"E2E-2026-0000123\",\n \"LodgementReference\": \"ACME INV 10023\",\n \"RemitterName\": \"ACME PTY LTD\",\n \"RejectionDateTime\": \"2026-09-10T14:35:02\",\n \"RejectionReasonDescription\": \"Account closed\",\n \"RejectionTransactionId\": \"884231704\"\n});\n\nvar requestOptions = {\n method: 'POST',\n headers: myHeaders,\n body: raw,\n redirect: 'follow'\n};\n\nfetch(\"https://api.mpay.com.au/NPPPAYMENTSTATUSEVENTWEBHOOK_TARGET_URL\", requestOptions)\n .then(response => response.text())\n .then(result => console.log(result))\n .catch(error => console.log('error', error));" }, { "id": "l3Qoeve4n5xZw8yMYMEnm", "language": "ruby", "label": "Ruby", "code": "require \"uri\"\nrequire \"json\"\nrequire \"net/http\"\n\nurl = URI(\"https://api.mpay.com.au/NPPPAYMENTSTATUSEVENTWEBHOOK_TARGET_URL\")\n\nhttps = Net::HTTP.new(url.host, url.port)\nhttps.use_ssl = true\n\nrequest = Net::HTTP::Post.new(url)\nrequest[\"accept\"] = \"application/json\"\nrequest[\"content-type\"] = \"application/json\"\nrequest[\"authorisation\"] = \"******\"\nrequest[\"verification-signature\"] = \"e+AFAj2W69rAwbsGn+rSSnFm2ISEblo0MXnx9Qtoh2k5mst1cEEpcrVSzGLjzOPlEL2Ea/iYLbFGzDdxVRTcNLINOhsXM/smimNjBt8sq30FbvSNMjlfDnrZ6FOIkl3E3cu9B+M4OVL8HafPohb67IRNDNyCnCvBM10qHrioiak=\"\nrequest[\"webhookid\"] = \"1234567\"\nrequest.body = JSON.dump({\n \"TransactionId\": \"884231703\",\n \"UniqueReference\": \"ACME-PAY-000123\",\n \"TransactionDate\": \"2026-09-10\",\n \"Amount\": \"150.00\",\n \"Status\": \"Successful\",\n \"AccountNumber\": \"12345678\",\n \"AccountName\": \"John A Smith\",\n \"Bsb\": \"802-985\",\n \"PayId\": \"john.smith@example.com\",\n \"PayIdType\": \"Email\",\n \"EndToEndId\": \"E2E-2026-0000123\",\n \"LodgementReference\": \"ACME INV 10023\",\n \"RemitterName\": \"ACME PTY LTD\",\n \"RejectionDateTime\": \"2026-09-10T14:35:02\",\n \"RejectionReasonDescription\": \"Account closed\",\n \"RejectionTransactionId\": \"884231704\"\n})\n\nresponse = https.request(request)\nputs response.read_body\n" }, { "id": "5xPaHTZzhhwqYm4ckTJI4", "language": "python", "label": "Python", "code": "import requests\nimport json\n\nurl = \"https://api.mpay.com.au/NPPPAYMENTSTATUSEVENTWEBHOOK_TARGET_URL\"\n\npayload = json.dumps({\n \"TransactionId\": \"884231703\",\n \"UniqueReference\": \"ACME-PAY-000123\",\n \"TransactionDate\": \"2026-09-10\",\n \"Amount\": \"150.00\",\n \"Status\": \"Successful\",\n \"AccountNumber\": \"12345678\",\n \"AccountName\": \"John A Smith\",\n \"Bsb\": \"802-985\",\n \"PayId\": \"john.smith@example.com\",\n \"PayIdType\": \"Email\",\n \"EndToEndId\": \"E2E-2026-0000123\",\n \"LodgementReference\": \"ACME INV 10023\",\n \"RemitterName\": \"ACME PTY LTD\",\n \"RejectionDateTime\": \"2026-09-10T14:35:02\",\n \"RejectionReasonDescription\": \"Account closed\",\n \"RejectionTransactionId\": \"884231704\"\n})\nheaders = {\n 'accept': 'application/json',\n 'content-type': 'application/json',\n 'authorisation': '******',\n 'verification-signature': 'e+AFAj2W69rAwbsGn+rSSnFm2ISEblo0MXnx9Qtoh2k5mst1cEEpcrVSzGLjzOPlEL2Ea/iYLbFGzDdxVRTcNLINOhsXM/smimNjBt8sq30FbvSNMjlfDnrZ6FOIkl3E3cu9B+M4OVL8HafPohb67IRNDNyCnCvBM10qHrioiak=',\n 'webhookid': '1234567'\n}\n\nresponse = requests.request(\"POST\", url, headers=headers, data=payload)\n\nprint(response.text)\n" } ], "selectedLanguageId": "JRM_waDWFUd7KsRbR1Zyg" }, "results": { "languages": [ { "id": "tutAVOnT7sV0vKxx43hLF", "language": "200", "code": "// Success. The notification passed validation and your endpoint has accepted responsibility for it. Return this as soon as the payload is persisted — do not wait for downstream processing. Monoova treats any 2xx as a successful delivery and will not retry.\n{\n \"status\": \"Received\",\n \"webhookId\": 1234567,\n \"receivedAt\": \"2026-09-10T14:32:12\"\n}" }, { "id": "l93biAkyS5r3wz5eDoTK7", "language": "400", "code": "// Bad Request. The notification could not be parsed, or a field failed your validation. Monoova will not retry a notification that is rejected with a 400, so return it only for a genuinely malformed payload — never for a transient fault on your side.\n{\n \"status\": \"Rejected\",\n \"errorCode\": \"INVALID_PAYLOAD\",\n \"errorMessage\": \"Field 'Amount' is not a valid decimal value.\",\n \"webhookId\": 1234567,\n \"receivedAt\": \"2026-09-10T14:32:12\"\n}" }, { "id": "vFDrmOfymDBd9EV1dKoPc", "language": "401", "code": "// Unauthorised. The Authorisation header was missing or did not match the value registered on the subscription, or the Verification-Signature header failed SHA256 verification against the Monoova public key. Return this without processing the payload.\n{\n \"status\": \"Rejected\",\n \"errorCode\": \"INVALID_PAYLOAD\",\n \"errorMessage\": \"Field 'Amount' is not a valid decimal value.\",\n \"webhookId\": 1234567,\n \"receivedAt\": \"2026-09-10T14:32:12\"\n}" }, { "id": "I2YLcAVaw0T0JCbMypWat", "language": "500", "code": "// Internal Server Error. Your endpoint accepted the notification but could not process it because of a fault on your side. Monoova retries a notification that fails with a 5xx, so return this — rather than a 400 — whenever the failure is transient and a redelivery could succeed.\n{\n \"status\": \"Rejected\",\n \"errorCode\": \"INVALID_PAYLOAD\",\n \"errorMessage\": \"Field 'Amount' is not a valid decimal value.\",\n \"webhookId\": 1234567,\n \"receivedAt\": \"2026-09-10T14:32:12\"\n}" } ], "selectedLanguageId": "tutAVOnT7sV0vKxx43hLF" } }, "children": [ { "text": "" } ] }