Straumur payment webhook receiver

Receives signed payment notifications from Straumur. Authenticates the request by verifying the hmacSignature against the company's HMAC key (looked up via the payment identified by checkout_reference).

Straumur retries any non-200 response, so this endpoint always returns 200 OK — invalid signatures and unknown references are logged and swallowed rather than surfaced as errors.

POST/v1/marketplace/payments/webhooks/straumur

Request Body

application/json

checkoutReference*string

Our internal correlation; lookup key for the affected payment.

payfacReference?string

Straumur's processor reference for the underlying transaction.

merchantReference*string

Payment ID we sent at session creation.

amount*string

Minor units, serialized as a string by Straumur.

currency*string

reason?string

success*string

Stringified boolean ("true" / "false") per Straumur's wire format.

hmacSignature*string

Base64-encoded HMAC-SHA256 over the canonical field order — verified server-side against the company's HMAC key.

additionalData?

Free-form key/value bag. Notable keys: eventType, paymentMethod, authCode, threeDAuthenticated, cardNumber.

Response Body

curl -X POST "https://api.noona.is/v1/marketplace/payments/webhooks/straumur" \
  -H "Content-Type: application/json" \
  -d '{
    "checkoutReference": "string",
    "merchantReference": "string",
    "amount": "string",
    "currency": "string",
    "success": "string",
    "hmacSignature": "string"
  }'

curl -X POST "https://api.noona.is/v1/marketplace/payments/webhooks/straumur" \  -H "Content-Type: application/json" \  -d '{    "checkoutReference": "string",    "merchantReference": "string",    "amount": "string",    "currency": "string",    "success": "string",    "hmacSignature": "string"  }'

Empty