In all responses related to payment transactions, the user may be redirected to the merchant’s success or cancel URL. Since these URLs may be publicly accessible, they may be triggered by unauthorized individuals.Therefore, it is recommended to include parameters such as status, invoice_id, order_id, and hash_key in the redirect URL. The merchant must validate the hash_key value to verify the validity and source of the incoming request.For recurring payments, a POST request is sent to the merchant’s webhook URL for each renewal transaction. Since webhook URLs may also be publicly accessible, the source of incoming requests must be verified using hash_key.The status values are as follows:3D Secure payments: The status parameter can have a value of 0 or 1.Recurring Webhook: The $status parameter can have a value of Completed or Fail.Refund Webhook: The status parameter can have a value of Completed or Fail.
