Webhook

For general webhook delivery mechanics and retry behaviour, see Event Notification.

This event covers the onboarding outcome only. The Qualification Supplement flow does not currently emit a webhook — see Get Qualification Renewal Status (note its documented known limitation).

SUBMERCHANT_ONBOARDING_RESULT

Sent when a sub-merchant onboarding application submitted via Onboard Sub-Merchant reaches a terminal review outcome (approved or rejected).

Delivery target

• The event is sent to the sub-merchant's own webhookUrl if one was supplied at onboarding.

• If no webhookUrl was supplied, delivery falls back to the merchant's centrally-configured global-collection webhook URL.

• If neither a URL nor a signing secret is configured, the webhook is silently skipped — this never blocks or fails the underlying business flow.

Event data

Field Name	Type	Description
type	string	Event type. Fixed value: SUBMERCHANT_ONBOARDING_RESULT.
requestId	string	The requestId supplied in the original Onboard Sub-Merchant request.
subMerchantId	string	Platform-assigned sub-merchant identifier.
status	string	Outcome of onboarding review. Enum: APPROVED, REJECTED.
errCode	string	Error code when status is REJECTED. Empty string when not applicable.
errMsg	string	Human-readable error description when status is REJECTED. Empty string when not applicable.
extData	string	Reserved for future use. Observed as the literal string "{}".
secureHash	string	Base64-encoded SHA-256 signature computed over the payload. See Event Notification.

Sample data (real captured payload)

{
  "type": "SUBMERCHANT_ONBOARDING_RESULT",
  "requestId": "1785378822666",
  "subMerchantId": "10000002",
  "status": "APPROVED",
  "errCode": "",
  "errMsg": "",
  "extData": "{}",
  "secureHash": "uShZfTAnYed0iG1KWpZHd7K01FRg74Mp65TOxeR4vbQ="
}

A rejected outcome carries the same fields with errCode/errMsg populated.

Verifying secureHash

See Event Notification for the secureHash algorithm. One detail specific to this event: use the secret key configured for the target webhookUrl (or the merchant's global-collection secret, when the fallback URL from Delivery target above is used) — not necessarily the merchant's default secret.