iMoney PA-O Integration

What is iMoney PA-O?

iMoney's Payment Aggregator — Online (PA-O) lets merchants collect digital payments through a single API. This guide covers the Payin service — internally also referred to as the Collection APIs — which handles the money-in flow. The integration follows a two-step Init → Execute flow, after which iMoney notifies your server of the final outcome via webhook.

Environments & Service URLs

Each service has its own dedicated subdomain on both UAT (sandbox) and Production (live). Use the relevant base URL for the API you're calling.

Three rules that govern everything

Changelog #

A short release history for this guide. For breaking changes, a migration note is sent separately to tech@ contacts.

Quick Start #

Five steps to go from zero to a working integration.

Credentials & Onboarding #

Routing Modes #

Your account is configured by iMoney for one routing mode, which determines which init endpoint you call. Calling the wrong init endpoint returns error 104.

Security Model #

Every request passes through five gates in order:

Incoming Request
  │
  ├─ [1] API-KEY header        →  Identifies your merchant account
  ├─ [2] IP Whitelist          →  Request IP must be pre-registered with iMoney
  ├─ [3] X-Timestamp header    →  Unix timestamp, must be within ±5 minutes of server time
  ├─ [4] X-Signature header    →  HMAC integrity check (required on init endpoints)
  └─ [5] Encrypted body        →  AES-256-GCM payload confidentiality

Required headers

X-Merchant-Ref validation by endpoint

Trusted iMoney IPs #

iMoney uses two Global Accelerator static IPs for ALL communication with merchant servers — both for callbacks we send to you and outbound API calls our system makes to you. Whitelist exactly these two:

India-Only Traffic Policy — RBI Data Localization #

Encryption #

All cryptographic operations are derived from your api_key + hash_key pair. Three steps: derive the key, encrypt the body, sign the request.

Key Derivation #

The 32-byte AES key is derived by SHA-256 hashing the concatenation of your api_key and hash_key.

import hashlib

def derive_key(api_key: str, hash_key: str) -> bytes:
    return hashlib.sha256(f"{api_key}{hash_key}".encode()).digest()

def derive_key_hex(api_key: str, hash_key: str) -> str:
    return hashlib.sha256(f"{api_key}{hash_key}".encode()).hexdigest()

const crypto = require('crypto');

function deriveKey(apiKey, hashKey) {
    return crypto.createHash('sha256').update(apiKey + hashKey).digest();
}
function deriveKeyHex(apiKey, hashKey) {
    return crypto.createHash('sha256').update(apiKey + hashKey).digest('hex');
}

function deriveKey(string $apiKey, string $hashKey): string {
    return hash('sha256', $apiKey . $hashKey, true);
}
function deriveKeyHex(string $apiKey, string $hashKey): string {
    return hash('sha256', $apiKey . $hashKey);
}

import java.security.MessageDigest;

public static byte[] deriveKey(String apiKey, String hashKey) throws Exception {
    MessageDigest md = MessageDigest.getInstance("SHA-256");
    return md.digest((apiKey + hashKey).getBytes("UTF-8"));
}
public static String deriveKeyHex(String apiKey, String hashKey) throws Exception {
    byte[] raw = deriveKey(apiKey, hashKey);
    StringBuilder sb = new StringBuilder();
    for (byte b : raw) sb.append(String.format("%02x", b));
    return sb.toString();
}

Encrypting the Request Body #

All payloads must be AES-256-GCM encrypted and wrapped in a JSON envelope.

Wire format

nonce_hex : ciphertext_hex : tag_hex

Wrapped in JSON

{ "data": "a3f8c2...<nonce>:<ciphertext>:<tag>...hex" }

import os, json
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

def encrypt_payload(payload: dict, api_key: str, hash_key: str) -> bytes:
    key   = derive_key(api_key, hash_key)
    nonce = os.urandom(12)
    plain = json.dumps(payload, sort_keys=True, separators=(',', ':')).encode()
    enc   = AESGCM(key).encrypt(nonce, plain, None)
    ct, tag = enc[:-16], enc[-16:]
    encrypted_str = f"{nonce.hex()}:{ct.hex()}:{tag.hex()}"
    return json.dumps({"data": encrypted_str}).encode()

function encryptPayload(payload, apiKey, hashKey) {
    const key    = deriveKey(apiKey, hashKey);
    const nonce  = crypto.randomBytes(12);
    const plain  = Buffer.from(JSON.stringify(payload), 'utf8');
    const cipher = crypto.createCipheriv('aes-256-gcm', key, nonce);
    const ct     = Buffer.concat([cipher.update(plain), cipher.final()]);
    const tag    = cipher.getAuthTag();
    const encStr = `${nonce.toString('hex')}:${ct.toString('hex')}:${tag.toString('hex')}`;
    return Buffer.from(JSON.stringify({ data: encStr }));
}

function encryptPayload(array $payload, string $apiKey, string $hashKey): string {
    $key   = deriveKey($apiKey, $hashKey);
    $nonce = random_bytes(12);
    ksort($payload);
    $plain = json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
    $ct    = openssl_encrypt($plain, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag, '', 16);
    $encStr = bin2hex($nonce) . ':' . bin2hex($ct) . ':' . bin2hex($tag);
    return json_encode(['data' => $encStr]);
}

public static String encryptPayload(String json, String apiKey, String hashKey) throws Exception {
    byte[] key   = deriveKey(apiKey, hashKey);
    byte[] nonce = new byte[12];
    new SecureRandom().nextBytes(nonce);
    Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
    cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(key, "AES"), new GCMParameterSpec(128, nonce));
    byte[] enc = cipher.doFinal(json.getBytes("UTF-8"));
    byte[] ct  = Arrays.copyOf(enc, enc.length - 16);
    byte[] tag = Arrays.copyOfRange(enc, enc.length - 16, enc.length);
    return "{\"data\":\"" + bytesToHex(nonce) + ":" + bytesToHex(ct) + ":" + bytesToHex(tag) + "\"}";
}

Computing the Signature #

The X-Signature header is required on all init, status, and balance endpoint calls. It proves that the request has not been tampered with in transit. (Execute calls rely on the AES-GCM auth-tag of the encrypted body for integrity and do not require a signature.)

Signature inputs by endpoint

def compute_signature(api_key, hash_key, timestamp, merchant_ref, amount, body_bytes):
    key_hex   = derive_key_hex(api_key, hash_key)
    body_hash = hashlib.sha256(body_bytes).hexdigest()
    message   = f"{api_key}|{timestamp}|{merchant_ref}|{amount}|{body_hash}"
    return hashlib.sha256(f"{message}{key_hex}".encode()).hexdigest()

function computeSignature(apiKey, hashKey, timestamp, merchantRef, amount, bodyBuffer) {
    const keyHex   = deriveKeyHex(apiKey, hashKey);
    const bodyHash = crypto.createHash('sha256').update(bodyBuffer).digest('hex');
    const message  = `${apiKey}|${timestamp}|${merchantRef}|${amount}|${bodyHash}`;
    return crypto.createHash('sha256').update(message + keyHex).digest('hex');
}

function computeSignature($apiKey, $hashKey, $timestamp, $merchantRef, $amount, $bodyBytes): string {
    $keyHex   = deriveKeyHex($apiKey, $hashKey);
    $bodyHash = hash('sha256', $bodyBytes);
    $message  = "{$apiKey}|{$timestamp}|{$merchantRef}|{$amount}|{$bodyHash}";
    return hash('sha256', $message . $keyHex);
}

public static String computeSignature(String apiKey, String hashKey, String timestamp,
                                       String merchantRef, String amount, byte[] bodyBytes) throws Exception {
    String keyHex = deriveKeyHex(apiKey, hashKey);
    MessageDigest md = MessageDigest.getInstance("SHA-256");
    String bodyHash  = bytesToHex(md.digest(bodyBytes));
    String message   = apiKey + "|" + timestamp + "|" + merchantRef + "|" + amount + "|" + bodyHash;
    md.reset();
    return bytesToHex(md.digest((message + keyHex).getBytes("UTF-8")));
}

Full Request Example #

End-to-end payin init in Python — encrypts payload, computes signature, posts to iMoney.

import hashlib, json, os, time, requests
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

API_KEY  = "your_api_key"
HASH_KEY = "your_hash_key"
BASE_URL = "https://uatpayin.imoneypg.com"

def payin_init(payload: dict) -> dict:
    body      = encrypt_payload(payload, API_KEY, HASH_KEY)
    timestamp = str(int(time.time()))
    signature = compute_signature(API_KEY, HASH_KEY, timestamp,
                                   payload["merchant_ref"], payload["amount"], body)
    resp = requests.post(
        f"{BASE_URL}/api/v3/payin/init/",
        data=body,
        headers={
            "Content-Type":   "application/json",
            "API-KEY":        API_KEY,
            "X-Timestamp":    timestamp,
            "X-Signature":    signature,
            "X-Merchant-Ref": payload["merchant_ref"],
            "X-Customer-IP":  payload.get("customer_ip", ""),
        },
        timeout=30,
    )
    return resp.json()

Transaction Lifecycle #

Your System                   iMoney Gateway                  Customer
    │                              │                              │
    │── Step 1: Init ─────────────▶│                              │
    │◀── transaction_id + pg_ref ──│                              │
    │    (valid for 5 minutes)     │                              │
    │── Step 2: Execute ──────────▶│                              │
    │◀── response_code: 001 ───────│                              │
    │  [show QR / UPI link to customer]                           │
    │                              │◀──── customer pays ──────────│
    │◀── WEBHOOK ──────────────────│                              │
    │   [poll status after ~5 sec] │                              │
    │── Status Check ─────────────▶│                              │
    │◀── response_code: 000/003 ───│                              │

Step 1 — Init (Own-Route Merchants) #

Headers: API-KEY, X-Timestamp, X-Signature, X-Merchant-Ref, X-Customer-IP, Content-Type: application/json

Request Fields

Request

curl -X POST https://uatpayin.imoneypg.com/api/v3/payin/init/ \
  -H "API-KEY: 9b80b436a5ff" \
  -H "X-Timestamp: 1716374400" \
  -H "X-Signature: a3f8c2d1e5b7..." \
  -H "X-Merchant-Ref: ORDER-20260526-001" \
  -H "X-Customer-IP: 203.0.113.45" \
  -H "Content-Type: application/json" \
  -d '{"data":"<encrypted_string>"}'

{
  "uid": "CUSTOMER-001",
  "merchant_ref": "ORDER-20260526-001",
  "amount": "1000.00",
  "currency": "INR",
  "payin_type": "INTENT",
  "route_name": "YOUR_MERCHANT_ROUTE",
  "customer_name": "Raj Kumar",
  "customer_mobile": "9876543210",
  "customer_email": "raj@example.com",
  "customer_vpa": "raj@upi",
  "description": "Order #ORD-12345"
}

Response — Success

{
  "response_code": "000",
  "message": "OK",
  "data": {
    "transaction_id": "220260526143022123456",
    "pg_ref": "220260526143022ABCD",
    "expires_in": 300
  }
}

Error Responses — Init (Own-Route)

Step 1 — Init (Platform-Route Merchants) #

This endpoint is for merchants configured with routing_source = PLATFORM. Same fields as Own-Route, except route_name is not accepted — iMoney auto-selects the best acquirer for the amount, currency, and payment type.

Error Responses — Init (Platform-Route)

All errors from Init (Own-Route) apply here with the same codes, except for these differences:

curl -X POST https://uatpayin.imoneypg.com/api/v3/payin/bank/init/ \
  -H "API-KEY: 197eaa2042e8" \
  -H "X-Timestamp: 1716374400" \
  -H "X-Signature: d4e6f8..." \
  -H "X-Merchant-Ref: ORDER-20260526-001" \
  -H "X-Customer-IP: 203.0.113.45" \
  -H "Content-Type: application/json" \
  -d '{"data":"<encrypted_string>"}'

{
  "uid": "CUSTOMER-001",
  "merchant_ref": "ORDER-20260526-001",
  "amount": "1000.00",
  "currency": "INR",
  "payin_type": "UPI",
  "customer_name": "Raj Kumar",
  "customer_mobile": "9876543210",
  "customer_email": "raj@example.com",
  "customer_vpa": "raj@upi",
  "description": "Order #ORD-12345"
}

Step 2 — Execute #

Headers: API-KEY, X-Timestamp, X-Merchant-Ref, Content-Type: application/json

Request Fields

Response — Pending Customer Action

{
  "response_code": "001",
  "message": "Transaction pending",
  "data": {
    "pg_ref": "PG20260526PAY001A",
    "transaction_id": "220260526143022123456",
    "payment_details": {
      "vpa": "merchant@upi",
      "qr_code": "<base64_or_svg_string>",
      "upi_link": "upi://pay?pa=merchant@upi&am=1000.00&cu=INR"
    }
  }
}

Error Responses — Execute

Status Check #

Headers: API-KEY, X-Timestamp, X-Signature, X-Merchant-Ref

Request

curl -X GET "https://payinstatus.imoneypg.com/api/v3/payin/status/PG20260526PAY001A/" \
  -H "API-KEY: 9b80b436a5ff" \
  -H "X-Timestamp: 1716374700" \
  -H "X-Signature: <computed_sig>" \
  -H "X-Merchant-Ref: ORDER-20260526-001"

Response — Invalid Signature

{
  "response_code": "109",
  "message": "X-Signature verification failed."
}

Response — Success (decrypted)

{
  "response_code": "000",
  "message": "Transaction successful",
  "data": {
    "pg_ref": "PG20260526PAY001A",
    "merchant_ref": "ORDER-20260526-001",
    "status": "Success",
    "captured_amount": "1000.00",
    "customer_utr": "CUT20260526999"
  }
}

Resend Callback # NEW · v1.5

Use this endpoint to manually re-trigger webhook delivery for a transaction whose webhook was not received (e.g. your server was down, the URL was misconfigured, or all automatic retry attempts were exhausted).

Headers: API-KEY, X-Timestamp, X-Merchant-Ref

Request

curl -X POST "https://payinstatus.imoneypg.com/api/v3/payin/resend-callback/PG20260526PAY001A/resend/" \
  -H "API-KEY: 9b80b436a5ff" \
  -H "X-Timestamp: 1716375000" \
  -H "X-Merchant-Ref: ORDER-20260526-001"

No request body required — the body may be empty or omitted.

Response — Accepted

{
  "response_code": "000",
  "message": "Callback queued for delivery.",
  "data": {
    "pg_ref": "PG20260526PAY001A"
  }
}

response_code: 000 means the webhook has been queued — not that it has been delivered. Allow up to 30 seconds for delivery to your endpoint.

Error Responses — Resend Callback

Action by Response

Balance Check # NEW · v1.1

Read your current available balance held with iMoney. Useful for dashboards, reconciliation tooling, and balance monitoring.

Headers: API-KEY, X-Timestamp, X-Signature, X-Merchant-Ref

Request

curl -X GET "https://payinstatus.imoneypg.com/api/v3/payin/balance/" \
  -H "API-KEY: 9b80b436a5ff" \
  -H "X-Timestamp: 1716374700" \
  -H "X-Signature: <computed_sig>" \
  -H "X-Merchant-Ref: BALANCE-CHECK"

Response — Success (decrypted)

{
  "status": "success",
  "response_code": "000",
  "data": {
    "balance": "25000.00",
    "currency": "INR"
  },
  "message": "",
  "timestamp": "1716374700"
}

Response — Authentication Error

{
  "status": "error",
  "response_code": "401",
  "data": null,
  "message": "API-KEY is not recognised.",
  "timestamp": "1716374700"
}

Response Code Reference #

Edge / CloudFront Error Codes # NEW · v1.2.2

iMoney's APIs sit behind a CloudFront CDN edge. The HTTP status codes listed below are returned by CloudFront itself — they mean the request never reached our backend, so no response_code JSON body will be present. These are categorically different from the response_code values inside our normal JSON responses (Section Response Code Reference).

4xx — Client-Side / Request Errors

5xx — Edge / Upstream Errors

Transaction Status Reference #

When to Mark Success, Failed, or Pending #

The One Decision You Must Get Right — Execute

Execute called
      │
      ├── Got response_code + message?
      │       │
      │       ├── 001 ──────────────────────────────────────▶ PENDING — show UI, await webhook
      │       ├── 104/106/110/111 (not "already used") ─────▶ FAILED — no payment, restart with new merchant_ref
      │       ├── 101 with ref:XXXXXXXX ───────────────────▶ PENDING — contact ops, do NOT retry
      │       └── anything else ──────────────────────────▶ PENDING — check status after ~5 seconds
      │
      └── No response (timeout / 5xx / your exception)?
              │
              └─────────────────────────────────────────────▶ PENDING — check status after ~5 seconds, do NOT retry execute

When Retry Init Is Safe

You may only call Init again (with a new merchant_ref) when you have confirmed one of:

• iMoney returned an error that definitively means no payment was created (codes 104, 106 mismatch, 110, 111 expired/not-found).
• Status check by merchant_ref returned 404 — the transaction does not exist in iMoney's system.
• iMoney support explicitly tells you the transaction was not processed.

In all other cases, keep Pending and investigate before creating a new transaction.

Master Decision Table — By Signal Source

Definitive guide for every signal your integration will encounter.

Unexpected Scenarios — Always Keep Pending #

When something unexpected happens — network error, ambiguous response, exception in your code, timeout — always keep the transaction Pending.

Webhook Integration #

Delivery Mechanism

When a payin reaches a final state, iMoney sends an encrypted HTTP POST to your webhook URL.

• Webhook callbacks originate from the dedicated webhook subdomain:
  Production: payinhooks.imoneypg.com · UAT: uatpayinhooks.imoneypg.com
• The TCP source IP is always one of iMoney's two static GA IPs: 166.117.126.71 or 99.83.230.145. Whitelist both.
• iMoney attempts delivery 5 times total (1 initial + 4 retries). The retry schedule is fixed: immediate → 30 sec → 2 min → 10 min → 1 hr. After all 5 attempts are exhausted, no further retries occur.
• Your endpoint must be idempotent — process each pg_ref exactly once.

Webhook Payload #

iMoney sends a POST with these headers:

Content-Type: application/json
X-Webhook-Timestamp: <unix_epoch>
X-Pg-Ref: <pg_ref>
X-Api-Key: <your_api_key>
X-Merchant-Ref: <your_merchant_ref>

Raw body

{
  "encrypted": "<nonce_hex>:<ciphertext_hex>:<tag_hex>",
  "timestamp": "1716374800",
  "pg_ref": "PG20260526PAY001A"
}

Decrypted payload — Success

{
  "event": "payin.status_update",
  "data": {
    "pg_ref": "PG20260526PAY001A",
    "merchant_ref": "ORDER-20260526-001",
    "transaction_status": "Success",
    "amount": "1000.00",
    "captured_amount": "1000.00",
    "payin_method": "INTENT",
    "customer_utr": "CUT20260526999",
    "customer_upi": "user@upi",
    "bank_ref": "UTR123456789",
    "acquirer_ref": "ACQ20260526001",
    "currency": "INR",
    "created_at": "2026-05-26T10:05:00+05:30",
    "updated_at": "2026-05-26T10:05:30+05:30"
  }
}

Event: payin.test — Test Webhook NEW · v1.1

Fired from the iMoney merchant dashboard when you use the "Send Test Webhook" function. No action is required — just decrypt to confirm your endpoint is wired correctly, then return HTTP 200.

{
  "event": "payin.test",
  "data": {
    "pg_ref": "TEST-PG-REF",
    "merchant_ref": "TEST-MERCHANT-REF",
    "message": "This is a test webhook from iMoney. No action required."
  }
}

Decrypted payload fields

Acknowledging the Webhook #

Your endpoint must return HTTP 200 immediately — before processing.

from django.http import HttpResponse
from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def payin_webhook(request):
    job_queue.enqueue(process_webhook, request.body)
    return HttpResponse("OK", status=200)

app.post('/webhook/payin', express.raw({ type: 'application/json' }), (req, res) => {
    jobQueue.add({ body: req.body });
    res.status(200).send('OK');
});

<?php
$body = file_get_contents('php://input');
enqueueWebhook($body);
http_response_code(200);
echo 'OK';
exit;

Trusting & Verifying the Webhook #

Two verification layers — use both:

Verification checklist

FUNCTION verify_and_process_webhook(source_ip, raw_body):

    // Step 1: IP check — only iMoney's two GA IPs
    IMONEY_TRUSTED_IPS = ["166.117.126.71", "99.83.230.145"]
    IF source_ip NOT IN IMONEY_TRUSTED_IPS:
        LOG "SUSPICIOUS: webhook from " + source_ip
        ALERT techpg@imoneypg.com
        RETURN HTTP 403

    // Step 2: Parse + decrypt
    envelope = JSON_DECODE(raw_body)
    TRY:
        payload = decrypt_webhook(envelope["encrypted"], api_key, hash_key)
    CATCH DecryptionError:
        LOG "Decryption failed — possible tampering"
        RETURN HTTP 200   // stop retries, do not process

    // Step 3: Idempotency
    txn = database.find(payload["data"]["pg_ref"])
    IF txn is None OR txn.is_final_state():
        RETURN HTTP 200

    // Step 4: Process
    UPDATE txn.status = payload["data"]["transaction_status"]
    IF status == "Success": release_order(txn)
    ELSE: allow_retry(txn)

    RETURN HTTP 200

Decrypting the Webhook #

Same key derivation and wire format as outbound requests.

def decrypt_webhook(encrypted_str, api_key, hash_key):
    nonce_hex, ct_hex, tag_hex = encrypted_str.strip().split(':')
    key   = derive_key(api_key, hash_key)
    nonce = bytes.fromhex(nonce_hex)
    ct    = bytes.fromhex(ct_hex)
    tag   = bytes.fromhex(tag_hex)
    plain = AESGCM(key).decrypt(nonce, ct + tag, None)
    return json.loads(plain)

function decryptWebhook(encryptedStr, apiKey, hashKey) {
    const [nh, ch, th] = encryptedStr.trim().split(':');
    const nonce = Buffer.from(nh, 'hex');
    const ct    = Buffer.from(ch, 'hex');
    const tag   = Buffer.from(th, 'hex');
    const key   = deriveKey(apiKey, hashKey);
    const d     = crypto.createDecipheriv('aes-256-gcm', key, nonce);
    d.setAuthTag(tag);
    return JSON.parse(Buffer.concat([d.update(ct), d.final()]).toString());
}

function decryptWebhook($encryptedStr, $apiKey, $hashKey): array {
    [$nh, $ch, $th] = explode(':', trim($encryptedStr));
    $key = deriveKey($apiKey, $hashKey);
    $plain = openssl_decrypt(hex2bin($ch), 'aes-256-gcm', $key,
                             OPENSSL_RAW_DATA, hex2bin($nh), hex2bin($th));
    if ($plain === false) throw new Exception('Decryption failed');
    return json_decode($plain, true);
}

public static Map decryptWebhook(String encryptedStr, String apiKey, String hashKey) throws Exception {
    String[] parts = encryptedStr.trim().split(":");
    byte[] nonce = hexToBytes(parts[0]);
    byte[] ct    = hexToBytes(parts[1]);
    byte[] tag   = hexToBytes(parts[2]);
    byte[] key   = deriveKey(apiKey, hashKey);
    Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
    cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(key, "AES"), new GCMParameterSpec(128, nonce));
    byte[] ctTag = new byte[ct.length + tag.length];
    System.arraycopy(ct, 0, ctTag, 0, ct.length);
    System.arraycopy(tag, 0, ctTag, ct.length, tag.length);
    return parseJson(new String(cipher.doFinal(ctTag), "UTF-8"));
}

Dispute Webhook Flow #

How Disputes Differ from Normal Flow

A dispute opens when a previously-terminal transaction (e.g. Success) is contested. Runs on a separate webhook track.

Dispute Raised Webhook #

X-Webhook-Timestamp: <unix_epoch>
X-Pg-Ref: <pg_ref>
X-Api-Key: <your_api_key>
X-Merchant-Ref: <your_merchant_ref>
X-Dispute-Id: <dispute_id>
X-Event: payin.dispute_raised

{
  "event": "payin.dispute_raised",
  "data": {
    "pg_ref": "PG20260526PAY001A",
    "merchant_ref": "ORDER-20260526-001",
    "dispute_id": "DSP20260526001",
    "dispute_reason": "Customer claims payment not received",
    "dispute_category": "CHARGEBACK",
    "previous_status": "Success",
    "current_status": "Dispute",
    "amount": "1000.00",
    "currency": "INR",
    "raised_at": "2026-05-26T14:00:00+05:30"
  }
}

Dispute Resolved Webhook #

Carries the financial settlement detail.

Merchant Loss (chargeback upheld)

{
  "event": "payin.dispute_resolved",
  "data": {
    "pg_ref": "PG20260526PAY001A",
    "dispute_id": "DSP20260526001",
    "previous_status": "Dispute",
    "current_status": "Failed",
    "resolution": "MERCHANT_LOSS",
    "resolution_remark": "Chargeback upheld by customer bank",
    "amount": "1000.00",
    "not_settled_amount": "1000.00",
    "charges": "25.00",
    "debit": "1025.00",
    "credit": "0.00",
    "currency": "INR",
    "resolved_at": "2026-05-28T10:30:00+05:30"
  }
}

Merchant Win (dispute rejected)

{
  "event": "payin.dispute_resolved",
  "data": {
    "pg_ref": "PG20260526PAY001A",
    "dispute_id": "DSP20260526001",
    "previous_status": "Dispute",
    "current_status": "Success",
    "resolution": "MERCHANT_WIN",
    "resolution_remark": "Dispute rejected — original payment confirmed valid",
    "amount": "1000.00",
    "not_settled_amount": "0.00",
    "charges": "0.00",
    "debit": "0.00",
    "credit": "1000.00",
    "currency": "INR",
    "resolved_at": "2026-05-28T10:30:00+05:30"
  }
}

When to Mark Status During a Dispute #

Escalation & Support #

When escalating, always provide: merchant_ref, pg_ref, exact timestamp, and the full response/error received.

UAT Sign-off — Mandatory #

This document is confidential and intended solely for the named merchant. iMoney reserves the right to update API specifications. Breaking changes will be communicated separately with a migration guide.