{"info":{"_postman_id":"5ef67789-2136-468e-902b-8ee597f847fd","name":"Bonum Gateway APIs","description":"

Variables:
[ Testing Env ]

{{ API_BASE_URL }} : https://testapi.bonum.mn

{{ APP_SECRET }}: 1fc53f9389f489ff6e04617bd6338a710e1e7c579cb572aec421f560f363119c0e0039e4b765e53c5339c1e6c77279854b20e998ed4599983a9c9dba12b36e89ce7ee7659043ebffcf77a095587bf694

{{ DEFAULT_TERMINAL_ID }}: 17171119

{{ MERCHANT_CHECKSUM_KEY }} : 755753df1f8fb16da1131cc318f1bcec9b5df3e39ae5dee902900cd186e7ece8

[ Prod Env ]

{{ API_BASE_URL }} : https://apis.bonum.mn

{{ APP_SECRET }}: Ask Bonum

{{ DEFAULT_TERMINAL_ID }} : Ask Bonum

Localization:

Language:
Accept-Language: mn | en

use this header to all requestes to get back localized message.

\n","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","toc":[],"owner":"6164222","collectionId":"5ef67789-2136-468e-902b-8ee597f847fd","publishedId":"2sB2cYbzu8","public":true,"customColor":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"FF6C37"},"publishDate":"2025-04-11T02:52:40.000Z"},"item":[{"name":"Authentication","item":[{"name":"Get token","event":[{"listen":"test","script":{"id":"bc0970fa-80d2-4642-bf3d-3d89d0b54c36","exec":["pm.test(\"Status code is 200\", function () {"," pm.response.to.have.status(200);","});","","var jsonData = pm.response.json();","pm.test(\"Token exists\", function () {"," "," pm.expect(jsonData).to.have.property(\"refreshToken\");"," pm.expect(jsonData).to.have.property(\"accessToken\");"," "," pm.environment.set(\"accessToken\", jsonData.accessToken);"," pm.environment.set(\"refreshToken\", jsonData.refreshToken);","});"],"type":"text/javascript","packages":{},"requests":{}}}],"id":"da580172-bbf2-4ed3-a31b-0c4c601f9bf6","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"GET","header":[{"key":"Authorization","value":"AppSecret {{APP_SECRET}}","type":"text"},{"key":"X-TERMINAL-ID","value":"{{DEFAULT_TERMINAL_ID}}","description":"

\n","type":"text"},{"key":"","value":"","type":"text"}],"body":{"mode":"raw","raw":"","options":{"raw":{"language":"json"}}},"url":"{{API_BASE_URL}}/bonum-gateway/ecommerce/auth/create","description":"

{{ APP_SECRET }}: It is created on the merchant portal
\n
{{ DEFAULT_TERMINAL_ID }}: create a terminal on merchant portal and use the terminalId value for this variable
\n

Caution:
This endpoint is protected by rate limiting. Excessive or too frequent requests will result in a TOO_MANY_REQUESTS error.

\n","urlObject":{"path":["bonum-gateway","ecommerce","auth","create"],"host":["{{API_BASE_URL}}"],"query":[],"variable":[]}},"response":[{"id":"6b38c8b7-2e6d-4061-aa67-3ffc61a535c5","name":"TOO_MANY_REQUEST: Rate Limit Response","originalRequest":{"method":"GET","header":[{"key":"Authorization","value":"AppSecret {{APP_SECRET}}","type":"text"},{"key":"X-TERMINAL-ID","value":"{{DEFAULT_TERMINAL_ID}}","type":"text"}],"body":{"mode":"raw","raw":"","options":{"raw":{"language":"json"}}},"url":"{{AUTH_URL}}/ecommerce/auth/create"},"status":"Too Many Requests","code":429,"_postman_previewlanguage":null,"header":[{"key":"Date","value":"Tue, 06 Jan 2026 07:41:48 GMT"},{"key":"Content-Type","value":"application/json"},{"key":"Transfer-Encoding","value":"chunked"},{"key":"Connection","value":"keep-alive"},{"key":"x-timezone","value":"Asia/Ulaanbaatar"},{"key":"Vary","value":"Origin"},{"key":"Vary","value":"Access-Control-Request-Method"},{"key":"Vary","value":"Access-Control-Request-Headers"},{"key":"X-Content-Type-Options","value":"nosniff"},{"key":"X-XSS-Protection","value":"0"},{"key":"Cache-Control","value":"no-cache, no-store, max-age=0, must-revalidate"},{"key":"Pragma","value":"no-cache"},{"key":"Expires","value":"0"},{"key":"X-Frame-Options","value":"DENY"}],"cookie":[],"responseTime":null,"body":"{\n \"traceId\": \"695cbcbce9d3faa6d491a7a08b388972\",\n \"errorCode\": null,\n \"error\": null,\n \"message\": \"Rate-Limit: Use previous token. Do not get token too frequently,\",\n \"data\": null,\n \"detail\": null,\n \"duration\": 452,\n \"status\": 429\n}"},{"id":"e8922355-0cfb-4cf8-bd4e-b857f96a2622","name":"Get token Success","originalRequest":{"method":"GET","header":[{"key":"Authorization","value":"AppSecret {{APP_SECRET}}","type":"text"},{"key":"X-TERMINAL-ID","value":"{{DEFAULT_TERMINAL_ID}}","type":"text"}],"body":{"mode":"raw","raw":"","options":{"raw":{"language":"json"}}},"url":"{{API_BASE_URL}}/bonum-gateway/ecommerce/auth/create"},"status":"OK","code":200,"_postman_previewlanguage":null,"header":[{"key":"Date","value":"Wed, 25 Feb 2026 03:39:18 GMT"},{"key":"Content-Type","value":"application/json"},{"key":"Transfer-Encoding","value":"chunked"},{"key":"Connection","value":"keep-alive"},{"key":"x-timezone","value":"Asia/Ulaanbaatar"},{"key":"Vary","value":"Origin"},{"key":"Vary","value":"Access-Control-Request-Method"},{"key":"Vary","value":"Access-Control-Request-Headers"},{"key":"x-dur","value":"47"},{"key":"x-trace-id","value":"699e6ee6aae8a46793fdd90e25ad77dc"},{"key":"X-Content-Type-Options","value":"nosniff"},{"key":"X-XSS-Protection","value":"0"},{"key":"Cache-Control","value":"no-cache, no-store, max-age=0, must-revalidate"},{"key":"Pragma","value":"no-cache"},{"key":"Expires","value":"0"},{"key":"X-Frame-Options","value":"DENY"}],"cookie":[],"responseTime":null,"body":"{\n \"tokenType\": \"Bearer\",\n \"accessToken\": \"bla bla\",\n \"expiresIn\": 1800,\n \"refreshToken\": \"bla bla\",\n \"refreshExpiresIn\": 2000,\n \"unit\": \"SECONDS\"\n}"}],"_postman_id":"da580172-bbf2-4ed3-a31b-0c4c601f9bf6"},{"name":"Refresh token","event":[{"listen":"test","script":{"id":"c0488e8e-57c4-4b75-9dc0-2985e5945e25","exec":["pm.test(\"Status code is 200\", function () {"," pm.response.to.have.status(200);","});","","var jsonData = pm.response.json();","pm.test(\"Token exists\", function () {"," console.log('accessToken',jsonData.accessToken);"," pm.expect(jsonData).to.have.property(\"accessToken\");"," pm.environment.set(\"accessToken\", jsonData.accessToken);","});"],"type":"text/javascript","packages":{},"requests":{}}}],"id":"7deae2af-7d1a-4eac-a9cc-4e3b19755e14","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"bearer","bearer":{"basicConfig":[{"key":"token","value":"{{refreshToken}}"}]},"isInherited":false},"method":"GET","header":[],"body":{"mode":"raw","raw":"","options":{"raw":{"language":"json"}}},"url":"{{API_BASE_URL}}/bonum-gateway/ecommerce/auth/refresh","urlObject":{"path":["bonum-gateway","ecommerce","auth","refresh"],"host":["{{API_BASE_URL}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"7deae2af-7d1a-4eac-a9cc-4e3b19755e14"}],"id":"b030b28a-ecb3-4fae-b799-57258002c4ab","_postman_id":"b030b28a-ecb3-4fae-b799-57258002c4ab","description":"","auth":{"type":"bearer","bearer":{"basicConfig":[{"key":"token","value":"{{accessToken}}"}]},"isInherited":true,"source":{"_postman_id":"5ef67789-2136-468e-902b-8ee597f847fd","id":"5ef67789-2136-468e-902b-8ee597f847fd","name":"Bonum Gateway APIs","type":"collection"}}},{"name":"Web payment / All in one","item":[{"name":"Get Payment Providers","id":"664b6eac-4944-44c9-a7f7-2d17a4a9ed27","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[],"url":"{{API_BASE_URL}}/bonum-gateway/ecommerce/invoices/payment-providers","description":"

This returns the active payment options that can be used for your customers.

This list can be added/modified.

for example:

QPAY: QR based payment, every bank, and fin-tech apps supports QPAY payment
\n
E_COMMERCE: Online Card Payment
\n
WE_CHAT: Chinese customers can use their WeChat wallet app to pay the payment.
\n
SONO_SHOP: Buy now, Pay Later. Customer can pay the payment with SonoShop.s loan.
\n

It creates an invoice and returns a follow-up link for the invoice.
\n
the browser or client must be redirected the follow-up link for the user to proceed the payment
\n
Once, the payment is completed successfully or cancelled, A notification will be sent to the callback
\n

callback (webhook) is a http(s) endpoint that our backend sends a notification to by using POST method when the user payment is done or cancelled.

callback (webhook) must be provided from your side and pre-configured or pre-defined on our side

POST body:

{\n    \"amount\" : 1,\n    \"callback\" : \"\",\n    \"transactionId\" : \"a123456789\", // len (min = 1, max = 80)\n    \"expiresIn\": 23000,  // seconds\n    \"providers\" : [\"QPAY\"], // optional, QPAY, WE_CHAT, SONO_SHOP, E_COMMERCE  see \"Get Payment Providers\"\n    \"items\" : [ // optional\n        {\n            \"image\" : \"https://mchat-test-resource.s3.amazonaws.com/merch_img_11_67107315ad5f5adcabe59b433ea363cfpng\",\n            \"title\" : \"Test 1\",\n            \"remark\" : \"Test Remark 1\",\n            \"amount\" : 1,\n            \"count\" : 1\n        }\n    ],\n    \"extras\" : [ //optional\n        {\n            \"placeholder\" : \"jordan24\",\n            \"type\" : \"TEXT\", // NUMBER,PHONE,EMAIL,TEXT, ALL,\n            \"required\" : true\n        }\n    ]\n}\n\n

This service returns the payment status created by the service \"Create Invoice\"

CAUTION: DO NOT USE THIS SERVICE ON PRODUCTION.

- To check invoice status, use your local data and webhook message delievery: Invoice record is stored on your side, and once a webhook is received, update the invoice row.

It creates an invoice and returns a follow-up link for the invoice.
\n
the browser or client must be redirected the follow-up link for the user to proceed the payment
\n
Once, the payment is completed successfully or cancelled, A notification will be sent to the callback
\n

callback is a http(s) endpoint that our backend sends a notification to by using POST method when the user payment is done or cancelled.

callback must be provided from your side and pre-configured or pre-defined on our side

POST body:

{\n    \"type\" : \"PAYMENT\",\n    \"status\" : \"SUCCESS\", // \"FAILED\"\n    \"body\" : {\n        \"amount\" : 100,\n        \"transactionId\" : \"abs12345678909876544321\",\n        \"invoiceId\" : \"321\"\n    }\n}\n\n

createInvoiceResponse.invoiceId

\n","type":"text/plain"},"key":"invoiceId","value":"22c4f07f9e198b3953dd1fbc7b240af6c2529c16437df58e54acfccf1278c98a"}],"variable":[]}},"response":[],"_postman_id":"c084f13e-d09a-46ac-93e3-979c9a1f14f9"},{"name":"WebHook - Create Invoice","id":"f1e17bd1-eb6c-48cb-8594-45d188a31768","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[],"description":"

Once after user completes the payment, the webhook message will be sent to the merchant's registered webhook.

See the examples for detail

It creates credit card tokenization request and returns a follow-up link.

the follow-up link will take the user throgth steps necessary. once the process is done and token is generated, \"webhook\" (server-to-server) notification (http-post) will be sent the merchant's webhook url which is registered in the merchat portal site

\"callback\" is the 3rd party's url, user browser will be redirected to this after tokenization process is done.
\n
\"transactionId\" is the 3rd party's unique id for the tokenization request, it will be attached to the tokenization process and will be sent to the 3rd party's web-hook url with the customer credit card token.
\n
\"payment\" is an optional field, when actual payment transaction and token is processed, you can use payment.amount field. if no payment.amout is passed, 0.01 MNT will be processed for verfication.
\n
\"subscription\" is optional, if set, the card token is SUBSCRIBED to the payment plan
\n
- \"planId\" merchant's payment plan Id, can be found \"List of Payment Plans\" service.
  \n
- \"cycleValue\" possible values based on the given plan
  \n
  - 1 - 7 for WEEKLY plan, 1-Mon, ... 7-Sun
    \n
  - 1 - 31 for MONTHLY plan
    \n
  - 1 - 366 for YEARLY plan
    \n
  \n
- \"cycles\" is optional, how many cycles the subscription runs for. If no value to this, the subscription will be active for good. For example: cycles=10, it means the subscription will be active for 10 cycles. If cycles=null, the subscription will be active until the cancellation request is issued.
  \n
- \"payNow\" if true, \"cycleValue\" will be ignored, the current date becomes the first billing date, and the next billing date will be calculated with payment plan's recurring type on the current date.
  \n
- \"custEmail\" is optional, subsription payment notification will be sent to this email.
  \n
\n
\"items\" is optinal.
\n
- \"image\" item's image url shown on the hosted page.
  \n
- \"title\" item's title shown on the hosted page.
  \n
\n

NOTE: If subscription date is the same day of payment plan's cycleValue, then payment transaction is processed upon the subscription. For example: Let take a monthly payment plan, its cycleValue is 1 which means the first day of every month, payment is processed automatically, and if a user subscribes to it on the first day of a month, the payment is immediately processed during the subscription.

On a successful card token generation, a webhook message will be sent the merchant's registered webhook message.

Webhook message fields:

\"token\" card token string.
\n
\"mask\" masked card number
\n
\"expiry\" card's expire month
\n
\"bank\" card's issuer bank
\n
\"transactionId\" merchant's transaction id used in \"Card Create Token\" request body
\n
\"amounts\" дүнтэй, эсвэл subscription.тай үед төлбөрийн дүн
\n
\"subscriptions\" payment plan руу subscribe хийсэн бол subscription.ны id
\n

Webhook message body:

{\n    \"type\":\"CARD-TOKEN\",\n    \"status\":\"SUCCESS\",\n    \"message\":\"\",\n    \"body\":{\n        \"token\":\"1fc53f9389f489ff6e04617bd6338a710e1e7c579cb572aec421f560f363119c45de074278126f4e9adbc626cccba687513731bc9f8cd1737efed3e58d30dfb9\",\n        \"mask\":\"5150 23** **** 4778\",\n        \"expiry\":\"2026/11\",\n        \"bank\":{\n            \"id\":19,\n            \"code\":\"150000\",\n            \"name\":\"Голомт банк\",\n            \"icon\":\"https://bonum-prod-resource.s3.us-east-2.amazonaws.com/golomt.png\",\n            \"iBanCode\":\"0015\",\n            \"transferCode\":\"GMT\"\n        },\n        \"transactionId\":\"6ab20250512180511006\",\n        \"completedAt\":\"2026-01-26 12:58:03\",\n        \"amounts\":[\n            {\n                \"amount\":5.00,\n                \"currency\":\"MNT\"\n            }\n        ],\n        \"subscriptions\":[\n            {\n                \"subscriptionId\":1,\n                \"planId\":1,\n                \"nextBillingDate\":\"2026-02-02 00:00:00\",\n            }\n        ]\n    }\n}\n\n

Make a Payment Using a Card Token

This endpoint initiates a payment using a previously generated card token.

Note:

During periods of high traffic, payment requests may be placed into a processing queue. Queued payments will be executed asynchronously, and the final result will be delivered to the merchant’s configured webhook endpoint.

Caution:

Do not rely on or expose the response[\"errorCode\"] field. This field is intended for internal use only.

Additional Information:
For detailed behavior and possible outcomes, refer to the sample request and response examples

When purchase is queued, and completed the payment asyncronously, this webhook message will be sent

{\n    \"type\":\"TOKEN-PAYMENT\",\n    \"status\":\"SUCCESS\", // SUCCESS | FAILED\n    \"message\":\"\",\n    \"body\":{\n        \"transactionId\":\"6ab20250512180511006\",\n        \"completedAt\":\"2026-01-26 12:58:03\",\n    }\n}\n\n

this service tries to reverse a token payment.

transactionId pathvariable is the merchant's transactionid value.

Merchant's transactionId

\n","type":"text/plain"},"type":"any","value":"","key":"transactionId"}]}},"response":[],"_postman_id":"d8b8ebf4-253b-4354-9ee8-02d0eeb54424"}],"id":"b656f08d-e5e5-40c6-bed4-66ad63966bda","description":"

Request Headers:

X-CARD-TOKEN: must be attached to request header, its value is sent to the 3rd party's webhook endpoint once credit card token is generated successfully

\n","_postman_id":"b656f08d-e5e5-40c6-bed4-66ad63966bda","auth":{"type":"bearer","bearer":{"basicConfig":[{"key":"token","value":"{{accessToken}}"}]},"isInherited":true,"source":{"_postman_id":"5ef67789-2136-468e-902b-8ee597f847fd","id":"5ef67789-2136-468e-902b-8ee597f847fd","name":"Bonum Gateway APIs","type":"collection"}}},{"name":"Subscription plans","item":[{"name":"List Of Payment Plans","id":"f0036f5d-f9b2-4a70-82b4-f8ee55e8b1d3","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[],"body":{"mode":"raw","raw":"","options":{"raw":{"language":"json"}}},"url":"{{API_BASE_URL}}/mpay-service/merchant/values/payment-plans","description":"

It returns the list of payment plans (subscription plans) of the merchant.
\n
Payment plan can be CRUD on merchant portal web
\n

This service subscribes a credit card token to a payment plan, specified \"planId\" field in the request body

\"planId\" merchant's payment plan Id, can be found \"List of Payment Plans\" service.
\n
\"cycleValue\" possible values based on the given plan
\n
- 1 - 7 for WEEKLY plan, 1-Mon, ... 7-Sun
  \n
- 1 - 31 for MONTHLY plan
  \n
- 1 - 366 for YEARLY plan
  \n
\n
\"cycles\" is optional, how many cycles the subscription runs for. If no value to this, the subscription will be active for good. For example: cycles=10, it means the subscription will be active for 10 cycles. If cycles=null, the subscription will be active until the cancellation request is issued.
\n
\"payNow\" if true, \"cycleValue\" will be ignored, the current data becomes the first billing date, and the next billing date will be calculated with payment plan's recurring type on the current date.
\n
\"custEmail\" is optional, subsription payment notification will be sent to this email.
\n

NOTE: If subscription date is the same day of payment plan's cycleValue, then payment transaction is processed upon the subscription. For example: Lets take a monthly payment plan with cycleValue = 1 (the first day of every month), payment is processed automatically, and if a user subscribes to it on the first day of a month, the payment will be processed immediately during the subscription.

It subscribes the credit card token to the payment plan

\"planId\" must be valid and created

It subscribes the credit card token to the payment plan

\"planId\" must be valid and created

It returns the subscriptions of the credit card token

It deletes the subscription of the credit card token from a payment plan

the next billing cycle payment will be executed at the next billing date

It deletes the subscription of the credit card token from a payment plan

no payment is created for the next billing cycle

It sends the card token, which was created with \"transactionId\" by the service \"Create Card Token\", to the merchant's web-hook

\"transactionId\" must be valid and assigned to a card token

Once card token is subscribed to a Payment plan. The payment process will be issued automatically on the billing date according to the payment plan's recurring type,
Then sends a webhook message to merchant's registered webhook url.

WebHook Message Body:

{\n    \"type\":\"SUBSCRIPTION-PAYMENT\",\n    \"status\":\"SUCCESS\", // SUCCESS | FAILED\n    \"message\":\"\",\n    \"body\":{\n        \"subscriptionId\":41,\n        \"invoiceId\":786,\n        \"planId\":4,\n        \"transactionId\":\"20000007\", // merchant's transaction id for the subscription.\n        \"completedAt\":\"2026-01-27 02:00:08\",\n        \"amount\":3,\n        \"currency\":\"MNT\"\n    }\n}\n\n

Use this service on SANDBOX environment to test subscription payment and expiration

Gets QR Invoice by qrCode (Qpay QrCode)

Pay Qr Invoice of qrCode with card-token

card token is sent as a http-header 'x-card-token'

in-app.н backend.с

token avna. // Authentication/Get Token
\n
Invoice үүсгэнэ // Invoice/Create Invoice
\n
Invoice.followuplink.г browser дуудна.
\n

in-app хэрэглэгч

төлбөрийн сонголтоос сонгон төлбөрөө төлнө ( Only Neo visible)

Neo App Backend (Payment Gateway).c

in-app.н бүртгэлтэй мерчантын web-hook ruu төлбөрийн мэдээлэлийг дамжуулна.

NOTE:

in-app мерчантаар бүртгүүлнэ
\n
web-hook бүртгүүлна
\n

Payment-Gateway.c мерчант руу гүйлгээний болон картын токены мэдээлэлийг дамжуулахдаа мерчантын бүртгүүлсэн webhook URL руу POST.р HTTP мессэж дамжуулдаг, Мөн хүсэлтийг баталжуулах checksum header.г илгээдэг

Жишээ:

merchant.н webhook url:

https://abx-xyz.mn/abcd/webhook-receiver\n\n

request body:

{\n    \"type\" : \"PAYMENT\",\n    \"status\" : \"SUCCESS\", //SUCCESS, FAILED\n    \"message\" : \"Амжилттай\", // Successful, or anything, this could be changed anytime, DO NOT RELY ON ITS VALUE,\n    \"body\" : {\n        \"invoiceId\": \"abc....xyz....\", //invoice unique id\n        \"transactionId\" : \"\", // 3rd party system's transcation id if the payment invoice was initiated with the 3rd party's transaction id\n    }\n}\nэсвэл\n{\n    \"type\" : \"CARD-TOKEN\",\n    \"status\" : \"SUCCESS\", //SUCCESS, FAILED\n    \"message\" : \"Амжилттай\", // Successful, or anything, this could be changed anytime, DO NOT RELY ON ITS VALUE,\n    \"body\" : {\n        \"token\": \"abc....xyz....\", //invoice unique id\n        \"transactionId\" : \"\", // 3rd party system's transcation id if the payment invoice was initiated with the 3rd party's transaction id\n    }\n}\n\n

Payment-Gateway sends transaction info or card token to merchants webhook URL with HTTP POST message and checksum HEADER value which is used as a validation

Example:

merchant's webhook url:

https://abx-xyz.mn/abcd/webhook-receiver\n\n

request body:

{\n    \"type\" : \"PAYMENT\",\n    \"status\" : \"SUCCESS\", //SUCCESS, FAILED\n    \"message\" : \"Амжилттай\", // Successful, or anything, this could be changed anytime, DO NOT RELY ON ITS VALUE,\n    \"body\" : {\n        \"invoiceId\": \"abc....xyz....\", //invoice unique id\n        \"transactionId\" : \"\", // 3rd party system's transcation id if the payment invoice was initiated with the 3rd party's transaction id\n    }\n}\nэсвэл\n{\n    \"type\" : \"CARD-TOKEN\",\n    \"status\" : \"SUCCESS\", //SUCCESS, FAILED\n    \"message\" : \"Амжилттай\", // Successful, or anything, this could be changed anytime, DO NOT RELY ON ITS VALUE,\n    \"body\" : {\n        \"token\": \"abc....xyz....\", //invoice unique id\n        \"transactionId\" : \"\", // 3rd party system's transcation id if the payment invoice was initiated with the 3rd party's transaction id\n    }\n}\n\n

Доор кодыг ашиглан webhook хүлээн авах үед баталгаажуулалт хийгээрэй.

fun checksumValidation(httpRequest : HttpRequest) : Boolean {\n    val MERCHANT_CHECKSUM_KEY = \"\" // this will be provided by offline or email from bonum. this MUST be kept in secure. \n    val raw = JSON.toJson(value = httpRequest.requestBody, prettyPrint = false)\n    val checksumValue = checksum(raw, MERCHANT_CHECKSUM_KEY)\n    val checksumHeaderValue = httpRequest.headers.get('x-checksum-v2')\n    val valid : Boolean = Objects.equals(checksumValue, checksumHeaderValue)\n    return valid\n}\nfun checksum(value : String, key : String) : String {\n    val secretKey = SecretKeySpec(key.toByteArray(Charsets.UTF_8), \"HmacSHA256\")\n    val mac = Mac.getInstance(\"HmacSHA256\")\n    mac.init(secretKey)\n    val hmacArray = mac.doFinal(value.toByteArray(Charsets.UTF_8))\n    //to Hex\n    val checksum = this.hex(hmacArray)\n    return checksum\n}\nprivate fun hex(vl : ByteArray) : String {\n    val sb = StringBuilder(vl.size * 2)\n    for(b in vl) {\n        sb.append(String.format(\"\u0002x\", b.toInt() and 0xff))\n    }\n    return sb.toString()\n} \n\n

The code below is for checksum validation.

You ask MERCHANT_CHECKSUM_KEY from the Payment-Gateway admin.

fun checksumValidation(httpRequest : HttpRequest) : Boolean {\n    val MERCHANT_CHECKSUM_KEY = \"\" // this will be provided by offline or email from bonum. this MUST be kept in secure. \n    val raw = JSON.toJson(value = httpRequest.requestBody, prettyPrint = false) // no indentation\n    val checksumValue = checksum(raw, MERCHANT_CHECKSUM_KEY)\n    val checksumHeaderValue = httpRequest.headers.get('x-checksum-v2')\n    val valid : Boolean = Objects.equals(checksumValue, checksumHeaderValue)\n    return valid\n}\nfun checksum(value : String, key : String) : String {\n    val secretKey = SecretKeySpec(key.toByteArray(Charsets.UTF_8), \"HmacSHA256\")\n    val mac = Mac.getInstance(\"HmacSHA256\")\n    mac.init(secretKey)\n    val hmacArray = mac.doFinal(value.toByteArray(Charsets.UTF_8))\n    //to Hex\n    val checksum = this.hex(hmacArray)\n    return checksum\n}\nprivate fun hex(vl : ByteArray) : String {\n    val sb = StringBuilder(vl.size * 2)\n    for(b in vl) {\n        sb.append(String.format(\"\u0002x\", b.toInt() and 0xff))\n    }\n    return sb.toString()\n} \n\n

\n","auth":{"type":"bearer","bearer":{"basicConfig":[{"key":"token","value":"{{accessToken}}"}]},"isInherited":true,"source":{"_postman_id":"5ef67789-2136-468e-902b-8ee597f847fd","id":"5ef67789-2136-468e-902b-8ee597f847fd","name":"Bonum Gateway APIs","type":"collection"}},"urlObject":{"query":[],"variable":[]},"url":""},"response":[],"_postman_id":"8c0722d9-91f2-46b2-a1b5-79a8c7e6bda4"},{"name":"Webhook Messages","id":"60feb9bf-70fb-499b-bb02-f7f9ecc728b3","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"auth":{"type":"bearer","bearer":{"basicConfig":[{"key":"token","value":"{{accessToken}}"}]},"isInherited":true,"source":{"_postman_id":"5ef67789-2136-468e-902b-8ee597f847fd","id":"5ef67789-2136-468e-902b-8ee597f847fd","name":"Bonum Gateway APIs","type":"collection"}},"urlObject":{"query":[],"variable":[]},"url":""},"response":[{"id":"64a19144-3040-44e7-8700-71323c22e702","name":"Online Payment Webhook Message (Success)","originalRequest":{"method":"GET","header":[{"key":"Content-Type","value":"application/json","type":"text"}],"body":{"mode":"raw","raw":"{\n \"type\": \"PAYMENT\",\n \"status\": \"SUCCESS\",\n \"message\": \"\",\n \"body\": {\n \"amount\": 28500.0,\n \"currency\": \"MNT\",\n \"completedAt\": \"2026-04-20 00:00:12\",\n \"paymentVendor\": \"QPAY\",\n \"initType\": \"ECOMMERCE\",\n \"status\": \"PAID\",\n \"transactionId\": \"\",\n \"token\": \"\", // when PAY_TOKEN type request initialized, the card token is on this field.\n \"extras-inputs\": [\n {\n \"id\": 1,\n \"placeholder\": \"Pleace enter your email\"\n }\n ],\n \"extras\": [\n {\n \"extraId\": 1,\n \"value\": \"test@gmail.com\"\n }\n ],\n \"paymentApp\": { // optional. wallet app or bank app.\n \"id\": 27,\n \"name\": \"Хас банк\",\n \"logoUrl\": \"https://bonum-prod-resource.s3.us-east-2.amazonaws.com/xac.png\"\n }\n }\n}","options":{"raw":{"language":"json"}}}},"_postman_previewlanguage":"","header":[],"cookie":[{"expires":"Invalid Date","domain":"","path":""}],"responseTime":null,"body":""},{"id":"97c0e283-f7d5-417f-9a38-2a37ae76a0dd","name":"Online Payment Webhook Message (Failure)","originalRequest":{"method":"GET","header":[{"key":"Content-Type","value":"application/json","type":"text"}],"body":{"mode":"raw","raw":"{\n \"type\": \"PAYMENT\",\n \"status\": \"FAILED\",\n \"message\": \"\", // when the payment processing results in error, the error description text is on this field.\n \"body\": {\n \"transactionId\": \"\",\n \"amount\": 35000.0,\n \"currency\": \"MNT\",\n \"updatedAt\": \"2026-04-20 00:00:15\",\n \"completedAt\": \"2026-04-20 00:00:15\",\n \"terminalId\": \"\", // Terminal ID, payment processing executed on.\n \"invoiceStatus\": \"EXPIRED\",\n \"status\": \"EXPIRED\" // CANCELLED, ERROR\n }\n}","options":{"raw":{"language":"json"}}}},"_postman_previewlanguage":"","header":[],"cookie":[{"expires":"Invalid Date","domain":"","path":""}],"responseTime":null,"body":""},{"id":"58627965-e10b-4652-9af1-c3f04a8511af","name":"Online Payment Webhook Message (Failure Card Payment Processing)","originalRequest":{"method":"GET","header":[{"key":"Content-Type","value":"application/json","type":"text"}],"body":{"mode":"raw","raw":"{\n \"type\": \"PAYMENT\",\n \"status\": \"FAILED\",\n \"message\": \"Insufficient Balance\", // error description text\n \"body\": {\n \"amount\": 50370.0,\n \"currency\": \"MNT\",\n \"completedAt\": \"2026-04-20 01:41:35\",\n \"terminalId\": \"17171896\",\n \"paymentVendor\": \"E_COMMERCE\",\n \"initType\": \"ECOMMERCE\",\n \"status\": \"ERROR\",\n \"respCode\": \"51\",\n \"transactionId\": \"\",\n \"extras-inputs\": [\n {\n \"id\" : 1,\n \"value\" : \"test@gmail.com\"\n \n }\n ],\n \"extras\": [\n {\n \"extraId\" : 1,\n \"placeholder\" : \"Pleace enter your email\"\n }\n ]\n }\n}","options":{"raw":{"language":"json"}}}},"_postman_previewlanguage":"","header":[],"cookie":[{"expires":"Invalid Date","domain":"","path":""}],"responseTime":null,"body":""},{"id":"2dc8fa48-0b2a-4dd5-9c6a-677a9fe3891f","name":"Card Tokenization Request Webhook Message (Success)","originalRequest":{"method":"GET","header":[{"key":"Content-Type","value":"application/json","type":"text"}],"body":{"mode":"raw","raw":"{\n \"type\": \"CARD-TOKEN\",\n \"status\": \"SUCCESS\",\n \"message\": \"\",\n \"body\": {\n \"token\": \"\",\n \"mask\": \"9496 28** **** 3501\",\n \"expiry\": \"2030/07\",\n \"bank\": {\n \"id\": 26,\n \"code\": \"050000\",\n \"name\": \"Хаан банк\",\n \"icon\": \"https://bonum-prod-resource.s3.us-east-2.amazonaws.com/khaan.png\",\n \"iBanCode\": \"0005\",\n \"transferCode\": \"050000|AGMOMNUB\"\n },\n \"transactionId\": \"\",\n \"completedAt\": \"2026-04-20 00:09:21\",\n \"amounts\": [],\n \"subscriptions\": []\n }\n}","options":{"raw":{"language":"json"}}}},"_postman_previewlanguage":"","header":[],"cookie":[{"expires":"Invalid Date","domain":"","path":""}],"responseTime":null,"body":""},{"id":"895d17c0-a071-4bbc-b4f0-ce94639fec50","name":"Card Tokenization Request Webhook Message (Failure)","originalRequest":{"method":"GET","header":[{"key":"Content-Type","value":"application/json","type":"text"}],"body":{"mode":"raw","raw":"{\n \"type\": \"CARD-TOKEN\",\n \"status\": \"FAILED\",\n \"message\": \"\",\n \"body\": {\n \"transactionId\": \"\",\n \"completedAt\": \"2026-04-22 15:10:52\",\n \"cardStatus\": \"CANCELLED\"\n }\n}","options":{"raw":{"language":"json"}}}},"_postman_previewlanguage":"","header":[],"cookie":[{"expires":"Invalid Date","domain":"","path":""}],"responseTime":null,"body":""}],"_postman_id":"60feb9bf-70fb-499b-bb02-f7f9ecc728b3"}],"id":"36c7281a-7ad8-4074-a259-b6149488d365","_postman_id":"36c7281a-7ad8-4074-a259-b6149488d365","description":"","auth":{"type":"bearer","bearer":{"basicConfig":[{"key":"token","value":"{{accessToken}}"}]},"isInherited":true,"source":{"_postman_id":"5ef67789-2136-468e-902b-8ee597f847fd","id":"5ef67789-2136-468e-902b-8ee597f847fd","name":"Bonum Gateway APIs","type":"collection"}}}],"auth":{"type":"bearer","bearer":{"basicConfig":[{"key":"token","value":"{{accessToken}}"}]}},"event":[{"listen":"prerequest","script":{"id":"c4c347f9-3d9d-4f8f-86f0-76b0fbd8d7dd","type":"text/javascript","packages":{},"exec":[""]}},{"listen":"test","script":{"id":"f3bf98ff-f97b-482b-8359-aa80aae7d154","type":"text/javascript","packages":{},"exec":[""]}}],"variable":[{"key":"xCardToken","value":"1fc53f9389f489ff6e04617bd6338a71ca27985bb080d06f01bed52475447345","type":"string"},{"key":"TOKEN_BASE_URI","value":"https://testapi.bonum.mn/mpay-service","type":"string","disabled":true},{"key":"BASE_URI","value":"https://testapi.bonum.mn/bonum-gateway","type":"string","disabled":true},{"key":"APP_SECRET","value":"1fc53f9389f489ff6e04617bd6338a710e1e7c579cb572aec421f560f363119c0e0039e4b765e53c5339c1e6c77279854b20e998ed4599983a9c9dba12b36e89ce7ee7659043ebffcf77a095587bf694","type":"string","disabled":true},{"key":"DEFAULT_TERMINAL_ID","value":"17171119","type":"string","disabled":true}]}