For transactions processed through SparkPay, SparkPay will send payment results as parameters via POST request to the merchant's system using the notify_url (asynchronous notification address) specified in the [Unified Payment Order Creation. See the notification details below.
Notification Mechanism: If the payment platform receives a non-compliant response or timeout from the merchant, it considers the notification failed and will reinitiate notifications (at intervals of 10s/1m/5m/10m/30m/1h/2h) to maximize the success rate, though final success is not guaranteed.Reception Mechanism: Asynchronous notification header is Content-Type:application/jsonRequest Business Message Encryption Details (Required for merchant application integration):
The public key used to encrypt the AES key is the merchant application's RSA public key. The RSA encryption uses RSAES-OAEP padding scheme, with SHA256 as the OAEP hash algorithm.
Request parameter JSON string encryption uses AES-256/CBC/PKCS5Padding algorithm, with the AES key being the pre-encrypted key (32-character string length, iv takes the first 16 characters of the key).
Both the encrypted request parameter JSON string and AES key use standard base64 encoding.
The signature value of the request parameter JSON string also uses base64 encoding.
Request Business Message Processing Method: Interface request field data uses standard base64 encoding and needs to be decoded first.
aes_key: Use merchant RSA private key to decrypt aes_key to obtain AESKEY.
body: Use AESKEY to decrypt and obtain payment result notification parameter JSON string.
sign: Verify signature using the payment platform public key with the notification parameter JSON string.
Response Method: Status code: 200; Response message: "SUCCESS".Important Notes:
1.
Asynchronous notification notify_url must be a complete URL starting with https:// or http://, ensuring the domain name and IP are publicly accessible.
2.
notify_url code processing logic must not include login status verification.
3.
The merchant's async address (notify_url) must be free of any characters like spaces or HTML tags, and cannot redirect.
4.
Merchant systems must respond within the platform's specified timeframe after receiving notifications, or the platform will consider it failed and resend notifications.
5.
Merchants with firewall restrictions must whitelist the payment center's specified IP ranges.
6.
The same notification may be sent multiple times; merchant systems must handle duplicate notifications correctly. If already processed, return success to the payment platform.