Gateway API

Gateway API reference

The Gateway service is the reseller integration layer for top-ups, bill payments, refunds, and order lookups. All business endpoints use POST with JSON bodies that include client credentials.

Base URL: http://localhost:3105/api/v1

Authentication

Every request must include the X-Api-Key, X-Timestamp, and X-Signature HTTP headers. Credentials are validated on every call; the JSON body never carries them.

Field	Type	Required	Description
`Content-Type`	string	Yes	Must be `application/json`
`X-Api-Key`	string	Yes	Shop API key issued by HubZell
`X-Timestamp`	integer	Yes	Unix timestamp in seconds; must be within ±5 minutes of server time
`X-Signature`	string	Yes	Hex HMAC-SHA256 digest of `secret_key`, keyed over `\n\n\n`

IP whitelist required. The caller IP must be registered in the shop's whitelist. An empty whitelist blocks all requests until IPs are configured in the reseller console.

const crypto = require('crypto');

const SECRET_KEY = process.env.GAMZ_SECRET_KEY;
const timestamp = Math.floor(Date.now() / 1000);

const method = 'POST';
const path = '/api/v1/balance';
const body = {
  // ...endpoint-specific fields
};
const rawBody = JSON.stringify(body);

const signature = crypto
  .createHmac('sha256', SECRET_KEY)
  .update(`${method}\n${path}\n${timestamp}\n${rawBody}`)
  .digest('hex');

const res = await fetch('{{BASE_URL}}/balance', {
  method,
  headers: {
    'content-type': 'application/json',
    'x-api-key': process.env.GAMZ_API_KEY,
    'x-timestamp': String(timestamp),
    'x-signature': signature,
  },
  body: rawBody,
});
const json = await res.json();

Console setup

Two things must be configured in the reseller console's Developer page before the Gateway API will accept your requests — a missing callback URL means order results never reach you, and an empty IP whitelist blocks every request outright.

1. Add your callback (webhook) URL

Log into the Reseller Console (your shop login).
Open the Developer tab in the sidebar.
Find the Callback URL section.
Paste your endpoint and click Save.

On the Developer page, paste your endpoint into the Callback URL field and click Save. HubZell posts order and refund results here as a signed JSON request — see Order result callback below for the exact payload and headers.

The URL must be publicly reachable (HTTPS strongly recommended — it's carrying live order/refund results over the open internet) and respond with HTTP 200 within a few seconds. Delivery is best-effort with no retry, so poll orders/status for anything you don't want to risk missing. Changes save immediately and apply to the next callback — no propagation delay.

Always verify X-OP-Webhook-Signature before trusting the payload — anyone can POST to a public URL. Minimal Node/Express example:

const crypto = require('crypto');

const SECRET_KEY = process.env.GAMZ_SECRET_KEY;

app.post('/gamz/callback', express.raw({ type: 'application/json' }), (req, res) => {
  const timestamp = req.header('x-op-webhook-timestamp');
  const signature = req.header('x-op-webhook-signature');
  const rawBody = req.body.toString('utf8');

  const expected = 'sha256=' + crypto
    .createHmac('sha256', SECRET_KEY)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  if (signature !== expected) return res.sendStatus(401);

  const payload = JSON.parse(rawBody);
  handleOrderResult(payload.dest_ref, payload.status);

  res.sendStatus(200);
});

2. Whitelist your IP

Log into the Reseller Console (your shop login).
Open the Developer tab in the sidebar.
Find the IP Whitelist section.
Add your server's IP address — add as many as you need, one at a time.

On the same page, click "Add my current IP" to whitelist the address you're browsing from, or type a specific IP under IP Whitelist and click Add. This step is required, not optional — an empty whitelist doesn't mean open access, it means every request is rejected with 403 IP_NOT_WHITELISTED until at least one IP is added.

IPs are added and removed one at a time, IPv4 or IPv6 (no CIDR ranges). There's no limit on how many you can whitelist, and a change takes effect on the very next request — it's checked live, not cached. Remove an entry the same way, from the same list.

If the server placing orders doesn't have a static outbound IP (common behind consumer NAT, some cloud auto-scaling groups, or residential/mobile connections), it'll need re-whitelisting whenever that IP changes. For anything beyond testing, place your integration behind a static IP or a NAT gateway with a fixed egress address.

Response format

Successful responses are wrapped in a uniform envelope. HTTP status codes reflect errors (401, 403, 404, 400, etc.) with the same JSON shape.

Success

{
  "status": 0,
  "code": "SUCCESS",
  "message": "success",
  "data": { ... }
}

Error

{
  "status": 1,
  "code": "INVALID_SIGNATURE",
  "message": "Invalid credentials",
  "data": null
}

Error codes

The error envelope's code field is always one of the following.

Code	HTTP status	Meaning
`MISSING_CREDENTIALS`	401	One or more of the X-Api-Key, X-Timestamp, or X-Signature headers is missing from the request.
`INVALID_TIMESTAMP_FORMAT`	401	X-Timestamp isn't a valid unix timestamp in seconds.
`EXPIRED_TIMESTAMP`	401	X-Timestamp is more than 5 minutes off from the server's clock.
`INVALID_SIGNATURE`	401	X-Signature doesn't match the expected HMAC — check your secret_key and how the signature string is built.
`IP_NOT_WHITELISTED`	403	The caller's IP isn't in your shop's IP whitelist. Add it on the reseller console's Developer page (see Console setup above) — an empty whitelist blocks every IP, it doesn't allow all of them.
`IP_BLOCKED`	403	This IP has been blocked by HubZell directly, independent of your shop's whitelist — typically abusive or scanning traffic.
`SHOP_DISABLED`	403	Your shop account has been disabled. Contact HubZell support.
`KYC_NOT_APPROVED`	403	Your shop's KYC hasn't been approved yet — order placement is disabled until it is.
`INSUFFICIENT_BALANCE`	400	Your wallet's available balance can't cover this request.
`CALLBACK_URL_REQUIRED`	400	Your shop's callback URL isn't configured yet — set one on the Developer page before placing orders.
`VALIDATION_ERROR`	400	The request body failed validation — check the response's message field for which field(s) are wrong.
`DUPLICATE_REQUEST`	409	This request has already been processed.
`MAINTENANCE_MODE`	503	The Gateway is temporarily under maintenance — retry shortly.
`NOT_FOUND`	404	The requested route doesn't exist — check the endpoint path and method.
`INTERNAL_ERROR`	500	An unexpected server error occurred. If this persists, contact HubZell support.

balance

POST{{BASE_URL}}/balance

Get wallet balance

Returns the authenticated shop wallet balance (available and held funds).

Headers

Required on every call, in addition to the request body below.

Field	Type	Required	Description
`Content-Type`	string	Yes	Must be `application/json`
`X-Api-Key`	string	Yes	Shop API key issued by HubZell
`X-Timestamp`	integer	Yes	Unix timestamp in seconds; must be within ±5 minutes of server time
`X-Signature`	string	Yes	Hex HMAC-SHA256 digest of `secret_key`, keyed over `\n\n\n`

Example headers

Content-Type: application/json
X-Api-Key: ak_b419becab1273243
X-Timestamp: 1783321239
X-Signature: a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f9

Request body

Send as application/json via POST to the endpoint above.

Example request

{}

Response

Also set on the response, in addition to the fields below.

Field	Type	Required	Description
`X-Currency`	string	No	Currency the response's amounts are denominated in (e.g. `THB`)

Field	Type	Required	Description
`shop`	string	No	Shop code
`currency`	string	No	Wallet currency (e.g. THB)
`available`	number	No	Spendable balance
`held`	number	No	Funds reserved for in-flight orders

Example response

{
  "status": 0,
  "code": "SUCCESS",
  "message": "success",
  "data": {
    "shop": "demo",
    "currency": "THB",
    "available": 50000,
    "held": 150
  }
}

POST{{BASE_URL}}/service

List provider services

Paginated catalog of enabled provider services (games, billers, top-up products). Requires a positive wallet balance — a shop with zero or negative available balance gets a 403 INSUFFICIENT_BALANCE instead of the catalog.

Headers

Required on every call, in addition to the request body below.

Field	Type	Required	Description
`Content-Type`	string	Yes	Must be `application/json`
`X-Api-Key`	string	Yes	Shop API key issued by HubZell
`X-Timestamp`	integer	Yes	Unix timestamp in seconds; must be within ±5 minutes of server time
`X-Signature`	string	Yes	Hex HMAC-SHA256 digest of `secret_key`, keyed over `\n\n\n`

Example headers

Content-Type: application/json
X-Api-Key: ak_b419becab1273243
X-Timestamp: 1783321239
X-Signature: a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f9

Request body

Send as application/json via POST to the endpoint above.

Field	Type	Required	Description
`page`	integer	No	Page number (default 1, minimum 1)
`limit`	integer	No	Items per page (default 20, max 100)
`category`	enum	No	Filter by category: MTOPUP \| CASHCARD \| GTOPUP \| BILLPAY
`company_id`	string	No	Filter by company id, e.g. MLBB

Example request

{
  "category": "GTOPUP",
  "page": 1,
  "limit": 20
}

Response

Also set on the response, in addition to the fields below.

Field	Type	Required	Description
`X-Currency`	string	No	Currency the response's amounts are denominated in (e.g. `THB`)

Field	Type	Required	Description
`items`	array	No	List of provider services
`items[].category`	enum	No	MTOPUP \| CASHCARD \| GTOPUP \| BILLPAY
`items[].company_id`	string	No	Reseller-facing product code — pass this exact value as company_id on /orders/payment, /orders/refund, and /orders/check-id
`items[].company_name`	string	No	Display name
`items[].image`	string \| null	No	Absolute URL of the service artwork
`items[].fee`	number	No	Service fee
`items[].minimum_amount`	number \| null	No	Minimum top-up amount
`items[].maximum_amount`	number \| null	No	Maximum top-up amount
`items[].refundable`	boolean	No	Whether refunds are supported
`items[].service`	array	No	Fixed-price plans, reseller price already marked up (empty for variable-amount services e.g. BILLPAY)
`items[].service[].code`	string	No	catalog_service code — pass this exact value as service_id on /orders/payment to select this plan directly
`items[].service[].price`	number	No	Reseller price for this plan (matches pay_to_amount, if you use that legacy field instead of service_id)
`items[].service[].name`	string	No	Plan label, e.g. "100 Diamonds"
`meta.page`	integer	No	Current page
`meta.limit`	integer	No	Page size
`meta.total`	integer	No	Total matching items
`meta.total_pages`	integer	No	Total pages

Example response

{
  "status": 0,
  "code": "SUCCESS",
  "message": "success",
  "data": {
    "items": [
      {
        "category": "GTOPUP",
        "company_id": "HUBZELLFLA71B",
        "company_name": "Mobile Legends: Bang Bang",
        "image": "https://hubzell.example.com/images/mlbb.png",
        "fee": 0,
        "minimum_amount": 10,
        "maximum_amount": 10000,
        "refundable": false,
        "service": [
          {
            "code": "HUBZELL6AM05HI3O",
            "price": 6.18,
            "name": "100 Diamonds"
          }
        ]
      }
    ],
    "meta": {
      "page": 1,
      "limit": 20,
      "total": 1,
      "total_pages": 1
    }
  }
}

orders

POST{{BASE_URL}}/orders/payment

Place payment / top-up

Charges the shop wallet and submits a top-up or bill payment to the upstream provider.

Headers

Required on every call, in addition to the request body below.

Field	Type	Required	Description
`Content-Type`	string	Yes	Must be `application/json`
`X-Api-Key`	string	Yes	Shop API key issued by HubZell
`X-Timestamp`	integer	Yes	Unix timestamp in seconds; must be within ±5 minutes of server time
`X-Signature`	string	Yes	Hex HMAC-SHA256 digest of `secret_key`, keyed over `\n\n\n`

Example headers

Content-Type: application/json
X-Api-Key: ak_b419becab1273243
X-Timestamp: 1783321239
X-Signature: a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f9

Request body

Send as application/json via POST to the endpoint above.

Field	Type	Required	Description
`category`	enum	No	Same category returned by /service (uppercase). Preferred over type — supply exactly one.
`type`	enum	No	Legacy alias for category (lowercase): billpay \| mtopup \| gtopup \| cashcard
`company_id`	string	No	catalog_product code (same value returned by /service). Preferred over pay_to_company — supply exactly one.
`pay_to_company`	string	No	Legacy alias for company_id
`service_id`	string	No	catalog_service code (same value returned by /service under items[].service[]) — selects the exact price tier directly, the server resolves the amount. Preferred over pay_to_amount — supply exactly one.
`pay_to_amount`	number	No	Legacy alias for service_id — matches a plan by reseller price instead. Supply exactly one of service_id / pay_to_amount.
`user_id`	string	No	Game account id — alias for pay_to_ref1 when category is GTOPUP. Supply exactly one.
`pay_to_ref1`	string	No	Phone number / bill account / game id. Required as-is for non-GTOPUP categories; legacy alias for user_id on GTOPUP.
`server_id`	string	No	Game server/zone id — alias for pay_to_ref2 when category is GTOPUP
`pay_to_ref2`	string	No	Reference 2 — required by some billpay services, or legacy alias for server_id on GTOPUP
`pay_to_ref3`	string	No	Reference 3 — required by some billpay services
`pay_to_barcode1`	string	No	Barcode number for barcode-based bill payments
`dest_ref`	string	Yes	Your unique order reference (alphanumeric, max 20 chars)

Example request

{
  "category": "GTOPUP",
  "company_id": "HUBZELLFLA71B",
  "service_id": "HUBZELL6AM05HI3O",
  "user_id": "312678959",
  "server_id": "3611",
  "dest_ref": "ORD20260708001"
}

Response

Field	Type	Required	Description
`type`	string	No	Resolved category, uppercase (echoes category if supplied, else type uppercased)
`pay_to_company`	string	No	The catalog_product code the order was placed against, echoed back
`pay_to_ref1`	string	No	The resolved target sent to the provider (user_id, or the exact string the provider's own format requires — see the ref format on /service if the provider rejects it)
`dest_ref`	string	No	Your order reference, echoed back
`total_amount`	number	No	Amount charged to your wallet — the catalog_service's reseller price (price_reseller), resolved server-side, never a client-supplied figure
`balance`	string	No	Your HubZell wallet balance after this charge (auto-refunded and reflected here if the provider then rejects the order)
`...`	object	No	Remaining fields are the provider's own raw response, spread as-is (field set varies; typically includes code, transaction_id, bill_id, queue_id)

Example response

{
  "status": 0,
  "code": "SUCCESS",
  "message": "success",
  "data": {
    "bill_id": "BILL0000123",
    "transaction_id": "987654321",
    "queue_id": "Q00045",
    "type": "GTOPUP",
    "pay_to_company": "HUBZELLFLA71B",
    "pay_to_ref1": "312678959 3611",
    "dest_ref": "ORD20260708001",
    "total_amount": 27.04,
    "balance": "49900.00"
  }
}

POST{{BASE_URL}}/orders/refund

Refund order

Requests a refund from the provider for a previously placed order. Wallet is credited on success.

Headers

Required on every call, in addition to the request body below.

Field	Type	Required	Description
`Content-Type`	string	Yes	Must be `application/json`
`X-Api-Key`	string	Yes	Shop API key issued by HubZell
`X-Timestamp`	integer	Yes	Unix timestamp in seconds; must be within ±5 minutes of server time
`X-Signature`	string	Yes	Hex HMAC-SHA256 digest of `secret_key`, keyed over `\n\n\n`

Example headers

Content-Type: application/json
X-Api-Key: ak_b419becab1273243
X-Timestamp: 1783321239
X-Signature: a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f9

Request body

Send as application/json via POST to the endpoint above.

Field	Type	Required	Description
`category`	enum	No	Same category returned by /service (uppercase). Informational only.
`type`	enum	No	Legacy alias for category (informational only): billpay \| mtopup \| gtopup \| cashcard
`transaction_id`	string	Yes	Provider transaction id returned when the order was placed
`dest_ref`	string	Yes	Order reference used when the order was placed (alphanumeric, max 20 chars)
`company_id`	string	No	catalog_product code of the original order. Informational only — the real provider-side code is resolved from the stored order, not from this field.
`pay_to_company`	string	No	Legacy alias for company_id (informational only)
`service_id`	string	No	catalog_service code of the original order. Informational only.
`new_msisdn`	string	No	New phone number for services that transfer credit to a new number

Example request

{
  "category": "GTOPUP",
  "company_id": "HUBZELLFLA71B",
  "service_id": "HUBZELL6AM05HI3O",
  "transaction_id": "987654321",
  "dest_ref": "ORD20260708001"
}

Response

Field	Type	Required	Description
`dest_ref`	string	No	Your order reference, echoed back
`balance`	string	No	Your HubZell wallet balance after this refund credit
`result`	string	No	Provider's raw refund response, e.g. "SUCCEED

Example response

{
  "status": 0,
  "code": "SUCCESS",
  "message": "success",
  "data": {
    "dest_ref": "ORD20260708001",
    "balance": "50000.00",
    "result": "SUCCEED|RID=1234"
  }
}

POST{{BASE_URL}}/orders/status

Get order status

Looks up a single order by your dest_ref reference.

Headers

Required on every call, in addition to the request body below.

Field	Type	Required	Description
`Content-Type`	string	Yes	Must be `application/json`
`X-Api-Key`	string	Yes	Shop API key issued by HubZell
`X-Timestamp`	integer	Yes	Unix timestamp in seconds; must be within ±5 minutes of server time
`X-Signature`	string	Yes	Hex HMAC-SHA256 digest of `secret_key`, keyed over `\n\n\n`

Example headers

Content-Type: application/json
X-Api-Key: ak_b419becab1273243
X-Timestamp: 1783321239
X-Signature: a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f9

Request body

Send as application/json via POST to the endpoint above.

Field	Type	Required	Description
`dest_ref`	string	Yes	Order reference used when the order was placed

Example request

{
  "dest_ref": "ORD20260708001"
}

Response

Field	Type	Required	Description
`dest_ref`	string	No	Your order reference
`category`	string	No	MTOPUP
`company_id`	string	No	catalog_product code the order was placed against
`user_id`	string	No	Phone / account / game id used for the order
`server_id`	string \| null	No	Game server/zone id, when the order carried one separately (null otherwise — some games require it pre-combined into user_id instead)
`status`	enum	No	PENDING \| SENT \| SUCCESS \| FAILED \| REFUNDED \| CANCELLED
`amount`	number	No	Order amount
`currency`	string	No	Currency code
`transaction_id`	string \| null	No	Provider transaction id
`message`	string \| null	No	Result message from provider
`failure_reason`	string \| null	No	Failure reason when status is FAILED
`created_at`	string	No	ISO 8601 creation timestamp
`completed_at`	string \| null	No	ISO 8601 completion timestamp

Example response

{
  "status": 0,
  "code": "SUCCESS",
  "message": "success",
  "data": {
    "dest_ref": "ORD20260708001",
    "category": "GTOPUP",
    "company_id": "HUBZELLFLA71B",
    "user_id": "312678959",
    "server_id": "3611",
    "status": "SUCCESS",
    "amount": 100,
    "currency": "THB",
    "transaction_id": "987654321",
    "message": null,
    "failure_reason": null,
    "created_at": "2026-07-08T02:30:00.000Z",
    "completed_at": "2026-07-08T02:30:05.000Z"
  }
}

POST{{BASE_URL}}/orders/history

Order history

Paginated list of orders for the authenticated shop with optional filters.

Headers

Required on every call, in addition to the request body below.

Field	Type	Required	Description
`Content-Type`	string	Yes	Must be `application/json`
`X-Api-Key`	string	Yes	Shop API key issued by HubZell
`X-Timestamp`	integer	Yes	Unix timestamp in seconds; must be within ±5 minutes of server time
`X-Signature`	string	Yes	Hex HMAC-SHA256 digest of `secret_key`, keyed over `\n\n\n`

Example headers

Content-Type: application/json
X-Api-Key: ak_b419becab1273243
X-Timestamp: 1783321239
X-Signature: a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f9

Request body

Send as application/json via POST to the endpoint above.

Field	Type	Required	Description
`page`	integer	No	Page number (default 1, minimum 1)
`limit`	integer	No	Items per page (default 20, max 100)
`status`	enum	No	Filter by status: PENDING \| SENT \| SUCCESS \| FAILED \| REFUNDED \| CANCELLED
`dest_ref`	string	No	Filter by your order reference
`date_from`	string	No	Orders created at or after (ISO 8601 date)
`date_to`	string	No	Orders created at or before (ISO 8601 date)

Example request

{
  "status": "SUCCESS",
  "page": 1,
  "limit": 20,
  "date_from": "2026-07-01",
  "date_to": "2026-07-31"
}

Response

Field	Type	Required	Description
`items`	array	No	Order records (same shape as order status response)
`meta`	object	No	Pagination metadata (page, limit, total, total_pages)

Example response

{
  "status": 0,
  "code": "SUCCESS",
  "message": "success",
  "data": {
    "items": [
      {
        "dest_ref": "ORD20260708001",
        "category": "GTOPUP",
        "company_id": "HUBZELLFLA71B",
        "user_id": "312678959",
        "server_id": "3611",
        "status": "SUCCESS",
        "amount": 100,
        "currency": "THB",
        "transaction_id": "987654321",
        "message": null,
        "failure_reason": null,
        "created_at": "2026-07-08T02:30:00.000Z",
        "completed_at": "2026-07-08T02:30:05.000Z"
      }
    ],
    "meta": {
      "page": 1,
      "limit": 20,
      "total": 1,
      "total_pages": 1
    }
  }
}

POST{{BASE_URL}}/orders/check-id

Check player ID

Validates a player/account id directly against the provider before placing an order — checks whether the account exists, without charging the wallet or creating an order record. Routed automatically to whichever provider owns company_id; returns 501 if that provider doesn't support id checking.

Headers

Required on every call, in addition to the request body below.

Field	Type	Required	Description
`Content-Type`	string	Yes	Must be `application/json`
`X-Api-Key`	string	Yes	Shop API key issued by HubZell
`X-Timestamp`	integer	Yes	Unix timestamp in seconds; must be within ±5 minutes of server time
`X-Signature`	string	Yes	Hex HMAC-SHA256 digest of `secret_key`, keyed over `\n\n\n`

Example headers

Content-Type: application/json
X-Api-Key: ak_b419becab1273243
X-Timestamp: 1783321239
X-Signature: a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f9

Request body

Send as application/json via POST to the endpoint above.

Field	Type	Required	Description
`company_id`	string	Yes	Same value as company_id from /service — identifies both the game/product and (via lookup) the provider to check against
`user_id`	string	Yes	Player / account / user id to validate
`server_id`	string	No	Server / zone id — required by some games, not others

Example request

{
  "company_id": "HUBZELLFLA71B",
  "user_id": "312678959",
  "server_id": "3611"
}

Response

Field	Type	Required	Description
`valid`	boolean	No	Whether the id resolved to a real account
`account_name`	string \| null	No	In-game display name for the resolved account, when the provider returns one
`error_code`	string \| null	No	Provider error code when not valid (e.g. INVALID_PLAYER_ID)
`error_message`	string \| null	No	Human-readable reason when not valid

Example response

{
  "status": 0,
  "code": "SUCCESS",
  "message": "success",
  "data": {
    "valid": true,
    "account_name": "PlayerOne",
    "error_code": null,
    "error_message": null
  }
}

webhooks

POST{shop callback_url}

Order result callback

When the upstream provider confirms an async payment or refund, HubZell relays the result to your shop's configured callback_url, as a JSON POST body. Only final statuses are delivered, best-effort with no retry — poll orders/status if you never receive one. The body carries a legacy `signature` field (MD5 of your secret_key + timestamp, kept for backward compatibility) — verify the stronger `X-OP-Webhook-Signature` header instead before trusting the payload.

Headers

Sent by HubZell on every callback, in addition to the JSON body below.

Field	Type	Required	Description
`Content-Type`	string	Yes	Always `application/json`
`X-OP-Webhook-Event`	string	Yes	Event name — always `order.updated`
`X-OP-Webhook-Event-ID`	string	Yes	Unique id for this delivery attempt, for deduplication
`X-OP-Webhook-Timestamp`	integer	Yes	Unix timestamp in seconds — same value as the body's `timestamp` field
`X-OP-Webhook-Signature`	string	Yes	`sha256=` followed by the hex HMAC-SHA256 digest of `secret_key`, keyed over `.` — a stronger signature than the body's `signature` field, verify either before trusting the callback

Example headers

Content-Type: application/json
X-OP-Webhook-Event: order.updated
X-OP-Webhook-Event-ID: 8f14e45f-ceea-467d-8a3f-2a1d4e3c9b2a
X-OP-Webhook-Timestamp: 1783321500
X-OP-Webhook-Signature: sha256=3f2504e04f8964efe040cbb8e5c9c3d1a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d

Callback payload

Posted to your as application/json.

Field	Type	Required	Description
`dest_ref`	string	Yes	Your order reference, as sent when the payment or refund was placed
`status`	string	Yes	Result status — SUCCESS or FAILED
`message`	string	No	Human-readable result message from the provider, when available
`transaction_id`	string	No	Provider transaction id, when available
`amount`	number	No	Amount charged for this order
`currency`	string	No	Currency code for amount
`timestamp`	integer	Yes	Unix timestamp in seconds this callback was signed at
`signature`	string	Yes	Legacy MD5 hex digest of `secret_key + timestamp`, kept in the body for backward compatibility — verify `X-OP-Webhook-Signature` instead, not this field

Example request

{
  "dest_ref": "ORD20260708001",
  "status": "SUCCESS",
  "message": "Top-up successful",
  "transaction_id": "987654321",
  "amount": 0.25,
  "currency": "USD",
  "timestamp": 1783321500,
  "signature": "3f2504e04f8964efe040cbb8e5c9c3d1"
}

Your response

Return HTTP 200 to acknowledge. The response body isn't read.

HubZell Gateway API

Authentication

Console setup

1. Add your callback (webhook) URL

2. Whitelist your IP

Response format

Error codes

balance

Get wallet balance

Headers

Request body

Response

List provider services

Headers

Request body

Response

orders

Place payment / top-up

Headers

Request body

Response

Refund order

Headers

Request body

Response

Get order status

Headers

Request body

Response

Order history

Headers

Request body

Response

Check player ID

Headers

Request body

Response

webhooks

Order result callback

Headers

Callback payload

Your response