> For the complete documentation index, see [llms.txt](https://docs.neox.vn/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.neox.vn/docs/global/global-collections/integration/sub-merchants/webhook.md).

# Webhook

For general webhook delivery mechanics and retry behaviour, see [Event Notification](/docs/global/global-collections/integration/event-notification.md).

{% hint style="info" %}
This event covers the **onboarding** outcome only. The Qualification Supplement flow does not currently emit a webhook — see [Get Qualification Renewal Status](https://github.com/neopayvn/neox-gitbook-documents-v2/tree/main/global-collections/integration/sub-merchants/get-qualification-renewal-status.md) (note its documented known limitation).
{% endhint %}

## SUBMERCHANT\_ONBOARDING\_RESULT

Sent when a sub-merchant onboarding application submitted via [Onboard Sub-Merchant](/docs/global/global-collections/integration/sub-merchants/api-onboard-sub-merchant.md) reaches a terminal review outcome (approved or rejected).

### Delivery target

* The event is sent to the sub-merchant's own `webhookUrl` if one was supplied at onboarding.
* If no `webhookUrl` was supplied, delivery falls back to the merchant's centrally-configured global-collection webhook URL.
* If neither a URL nor a signing secret is configured, the webhook is **silently skipped** — this never blocks or fails the underlying business flow.

### Event data

| Field Name    | Type   | Description                                                                                                                                              |
| ------------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| type          | string | Event type. Fixed value: `SUBMERCHANT_ONBOARDING_RESULT`.                                                                                                |
| requestId     | string | The `requestId` supplied in the original Onboard Sub-Merchant request.                                                                                   |
| subMerchantId | string | Platform-assigned sub-merchant identifier.                                                                                                               |
| status        | string | Outcome of onboarding review. Enum: `APPROVED`, `REJECTED`.                                                                                              |
| errCode       | string | Error code when `status` is `REJECTED`. Empty string when not applicable.                                                                                |
| errMsg        | string | Human-readable error description when `status` is `REJECTED`. Empty string when not applicable.                                                          |
| extData       | string | Reserved for future use. Observed as the literal string `"{}"`.                                                                                          |
| secureHash    | string | Base64-encoded SHA-256 signature computed over the payload. See [Event Notification](/docs/global/global-collections/integration/event-notification.md). |

### Sample data (real captured payload)

```json
{
  "type": "SUBMERCHANT_ONBOARDING_RESULT",
  "requestId": "1785378822666",
  "subMerchantId": "10000002",
  "status": "APPROVED",
  "errCode": "",
  "errMsg": "",
  "extData": "{}",
  "secureHash": "uShZfTAnYed0iG1KWpZHd7K01FRg74Mp65TOxeR4vbQ="
}
```

A rejected outcome carries the same fields with `errCode`/`errMsg` populated.

### Verifying `secureHash`

See [Event Notification](/docs/global/global-collections/integration/event-notification.md) for the `secureHash` algorithm. One detail specific to this event: use the secret key configured for the target `webhookUrl` (or the merchant's global-collection secret, when the fallback URL from [Delivery target](#delivery-target) above is used) — not necessarily the merchant's default secret.