> For the complete documentation index, see [llms.txt](https://aplazo.gitbook.io/aplazo-integrations/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aplazo.gitbook.io/aplazo-integrations/intro-for-aplazo-api-online/order-confirmation-webhook.md).

# Order confirmation - Webhook

Order confirmation is done via webhook. 

* The merchant should provide to Aplazo a URL in every payment request call, where Aplazo can notify the status change for the order. This could be just a POST endpoint .
*  The changes that are notified right now have this structure:

**{ “status":"string", "loanId":long, "cartId":"string"}**

Where **loanId** is the id of the loan in the aplazo side, and cartId is the order in the merchant side.

\
Example:

```
{
  "status": "Activo",
  "loanId": 57316,
  "cartId": "1f733d12-7f56-4181-8f84-b25d806e5473",
  "merchantId": 2305
}
```

***

### Status list available via webhook notification

This are the status communicated by Aplazo to merchant using the webhook:<br>

<table data-header-hidden><thead><tr><th width="221"></th><th width="234"></th><th></th></tr></thead><tbody><tr><td><strong>Status</strong></td><td><strong>Status Received</strong></td><td><strong>Description</strong></td></tr><tr><td>REQUEST</td><td>New</td><td>Loan request is received by Aplazo - NOT COMPLETED - This is the first status of the loan</td></tr><tr><td>OUTSTANDING</td><td>Activo</td><td>Loan confirmed by Aplazo and customer , this is already CONFIRMED and PAID</td></tr></tbody></table>

***

### Webhook Security

As part of Aplazo value offer is possible to configure an extra layer of security:

* Register Aplazo static IP addresses for all environments
* Configure a security token to be shared in the POST header of the webhook request.

### How does it work? <a href="#how-does-it-work" id="how-does-it-work"></a>

1. Merchant confirms the use of a security token, as well as the security type of the token: \
   Bearer or Basic.<br>

   <figure><img src="/files/LFlwASIj0jVFnbvYjJnD" alt=""><figcaption></figcaption></figure>

   2. Aplazo generates the token from the configuration defined with the merchant.

   <figure><img src="/files/Txz6aZEggg4W9i6BwGNc" alt=""><figcaption></figcaption></figure>

   3. Merchant receives the token and validates it to continue the flow on their side.

   <figure><img src="/files/1mY1ys4hSlwuxo15xwpM" alt=""><figcaption></figcaption></figure>

***

### Types of token

These are the 2 types of token enable for security communication with Merchant Webhook.

{% tabs %}
{% tab title="Bearer" %}

<figure><img src="/files/kXnevggErFerQ8duuzsj" alt=""><figcaption></figcaption></figure>
{% endtab %}

{% tab title="Basic" %}

<figure><img src="/files/q0bia7osNDvnCA4NKadc" alt=""><figcaption></figcaption></figure>
{% endtab %}
{% endtabs %}