Payment service notification (public)

POST 
/api/hooks/pay/:token

Doc 85 §14.1. PayTR's per-link notification (form post, hash over our callback_id; answered with a bare OK, 401 on a bad hash), the customer's browser coming back from iyzico's checkout (posts token, signs nothing — only a reason to ask iyzico; answered with an HTML page), and iyzico's optional merchant-wide webhook (X-IYZ-SIGNATURE-V3; a payment that is not one of our links is acknowledged and ignored). Who the payment belongs to is read from our link, never from the body.

Request

Responses

200

OK (PayTR), a page (iyzico browser return) or {ok: true} (webhook).

401

The signature did not hold; nothing was written.

503

The service could not be asked; PayTR / iyzico will retry.