1. API intro

Applicable object:Common modeInstitutional mode

Request URL: The URL is set by the parameter notify_url submitted in [Submit Refund API] and the https protocol is required. If the URL cannot be accessed, the merchant will not receive any WeChat notifications. The URL must be directly accessible without any parameters. For example: notify_url: http://pay.weixin.qq.com/wxpay/123456789

2. Notification Rules

After the refund status changes, WeChat will send the refund results to the merchant.

When notifying the interaction to the backend, if the response received by WeChat is unsuccessful or timeout, WeChat considers it as a notification failure and will send it again by following certain strategies to maximize the success rate, but WeChat does not guarantee a successful notification. （Notification frequency:15s/15s/30s/3m/10m/20m/30m/30m/30m/60m/3h/3h/3h/6h/6h - in total 24h4m）.

3. Notification Message

For refund result notifications, access the notification URL set up by the merchant with the `POST` method, and the notification data is transmitted through the request body (BODY) in the `JSON` format. The notification data contains the details of the encrypted refund result.

The procedure of how to decrypt the notification data is described as follows.

1、Obtain the merchant's notification key from the merchant platform, and record it as `key`.

2、Obtain the corresponding parameters `nonce` and `associated_data` for the algorithm described in `resource.algorithm` (which is `AEAD_AES_256_GCM`).

3、Decrypt the ciphertext `resource.ciphertext` with `key`, `nonce`, and `associated_data`, to obtain the resource objects in the Json format.

Notice

For the information on the API of the algorithm `AEAD_AES_256_GCM`, see rfc5116. The length of the `key` used for WeChat Pay is 32 bytes, the length of the random string `nonce` is 12 bytes, and the length of the `associated_data` is less than 16 bytes or may be zero.

4. Request Parameters

5. Notification Signature

Encryption does not guarantee that the notification request comes from wechat pay. Wechat pay will sign the notification sent to the merchant and put the signature value in the Wechatpay-Signature of Notification's HTTP header. The merchant should verify the signature to confirm that the request is from wechat pay, not other third parties. For the algorithm of signature verification, please refer to《Wechat Pay API V3 Signature Scheme》。

6. Notification example

Payment Success Result Notification

{
	"id": "f7c34059-0f2d-5b32-ba33-a42dks0597c5",
	"create_time": "2018-06-08T10:34:56+08:00",
	"resource_type": "encrypt-resource",
	"event_type": "REFUND.SUCCESS",
	"summary": "Refunded",
	"resource": {
		"original_type": "refund",
		"algorithm": "AEAD_AES_256_GCM",
		"ciphertext": "...",
		"associated_data": "",
		"nonce": "..."
	}
}

List of decrypted resource objects:

{
    "sp_mchid": "1900000100",
    "sub_mchid": "1900000109",
    "transaction_id": "1008450740201411110005820873",
    "out_trade_no": "20150806125346",
    "refund_id": "50200207182018070300011301001",
    "out_refund_no": "7752501201407033233368018",
    "refund_status": "SUCCESS",
    "success_time": "2018-06-08T10:34:56+08:00",
    "recv_account": "China Merchants Bank Credit Card 0403",
    "fund_source": "REFUND_SOURCE_UNSETTLED_FUNDS",
    "amount" : {
        "total": 528800,
        "currency": "HKD",
        "refund": 528800,
        "payer_total": 528800,
        "payer_refund": 528800,
        "payer_currency": "HKD",
        "exchange_rate" : {
            "type": "SETTLEMENT_RATE",
            "rate": 100000000
        }
    }
}

7. List of decrypted resource objects

8. Response Result

After the merchant's backend has properly processed the notification, HTTP status code 200 or 204 needs to be returned. No specific content is required for 204.For other HTTP status codes, WeChat Pay will deem the notification as a failure, and will send the notification regularly by following the aforesaid policies.

Notice

If the merchant's backend fails to process a response, WeChat Pay will record the response message. It is recommended to return in the following format.

{
    "code": "SUCCESS",
    "message": "Processed successfully"
}