Request Method: POST
Content-Type：application/json
Notification Address: The `notifyUrl` parameter passed when placing the order
Notification Content: JSON string, see the example below for the structure
When eSIM generation fails (notifyType=3), the system pushes this notification; the paid amount of the order is refunded to the buyer's account balance and the order status changes to refunded.
* Enter the callback notification URL. The system will send a sample notification payload via POST to this address (matching the actual notification format, including eventId, clientOrderNo and a real signature) to verify whether the URL can receive notifications properly.
{
"sn": "231013169",
"clientOrderNo": "your-order-no-001",
"eventId": "E20260810120000A1B2C3D4",
"notifyType": 1,
"activationStatus": "activated",
"iccid": "89852070322460401234",
"lpa": "LPA:1$xxx.prod.xxxxxxxxxxx.com$TEST1234567890",
"number": "86866878",
"verifyCode": "123456",
"qrcode": "data:image/png;base64,...",
"time": "20260810120000",
"sign": "3a1f9c2d1e4b85f6a7c8d9e0f1a2b3c4"
}
The sign value in the example above is a placeholder for illustration; the actual sign must be computed from the received body plus your API token. Click "Send Test" above to receive a real signed sample for self-testing.
| Field | Type | Description |
|---|---|---|
| sn | string |
Order No. |
| clientOrderNo | string |
Client order number (echoes back the clientOrderNo passed when ordering; only returned if provided) |
| eventId | string |
Event unique ID, globally unique and consistent across all resend deliveries of the same event (the eventId stays unchanged across multiple retries). Format: E + YmdHis + 8 hex digits. The callback receiver should use it for idempotent deduplication and troubleshooting; it participates in the signature. |
| notifyType | number |
【Notification Type】 1 - Card Activation Successful 2 - Unsubscribe 3 - Generation failed |
| activationStatus | string |
【eSIM Activation Status】 activated - Activated unsubscribed - Unsubscribed failed - Generation failed |
| iccid | string |
eSIM Card ICCID |
| lpa | string |
eSIM Configuration (Used to generate QR code), returned only for successful activation notifications |
| number | string |
eSIM Card Number, returned only for successful activation notifications |
| verifyCode | string |
eSIM Configuration Authentication Code, returned only for successful activation notifications |
| qrcode | string |
eSIM Configuration QR Code (base64 format), returned only for successful activation notifications |
| time | string |
Notification time (YmdHis, UTC+8 standard time) |
| sign | string |
Notification signature. The receiver uses it to verify the request origin and content integrity; see the "Signature Verification" section below for the algorithm. |
The notification payload includes a sign field; receivers should verify it to ensure the request is authentic and untampered.
Signature algorithm:
1. Decode the notification JSON body into an associative array.
2. Extract and keep the sign value, then remove the sign key from the array.
3. Add this account's API token (visible in the Developer Center) as the token key in the array.
4. Sort keys in descending order (krsort) and build a query string with http_build_query.
5. Compute md5 of the query string and compare it with the sign saved in step 2; reject the notification if they differ.
Note: the token only participates in the signature calculation and is not sent in the notification body; sign itself is not part of the signature.
Important: the algorithm above computes the sign over all fields actually present in the notification body (not a fixed field list). Therefore, when the platform later adds fields (such as eventId, clientOrderNo), verification logic implemented this way stays automatically compatible without changes. If you previously implemented verification with a hardcoded field list, be sure to include eventId (and clientOrderNo when echoed) in the set of fields participating in the signature, otherwise verification will fail.
<?php
// 1、通知以 Content-Type: application/json POST，必须读取原始请求体，不能用 $_POST
$rawBody = file_get_contents('php://input');
$payload = json_decode($rawBody, true);
if (!is_array($payload)) {
http_response_code(400);
exit('invalid json');
}
// 2、取出并移除 sign（sign 不参与自身签名）
$sign = $payload['sign'] ?? '';
unset($payload['sign']);
// 3、加入本账号 API token（开发者中心可见，仅参与签名、不随通知外发）
$payload['token'] = $myApiToken;
// 4、按 key 降序排序后拼接，分隔符固定使用 '&'（必须与平台算法保持一致）
krsort($payload);
$expected = md5(http_build_query($payload, '', '&'));
// 5、比对签名，不一致直接拒绝处理
if (!hash_equals($expected, $sign)) {
http_response_code(400);
exit('sign invalid');
}
// 6、验签通过后按 eventId 幂等去重（同一事件多次重试只处理一次），再执行业务
$eventId = $payload['eventId'] ?? '';
// TODO：查本地记录，若该 eventId 已处理过则直接返回 200，避免重复发货/重复对账
// 7、处理完成务必返回 HTTP 200，系统据此判定通知投递成功
http_response_code(200);
echo 'OK';
1. Please return HTTP status code 200 upon receiving the notification, which the system uses to determine a successful notification.
2. If a status other than 200 is returned or the address is unreachable, the system will retry at increasing intervals, up to a maximum of 3 attempts (about 5 minutes after the first failure for the 2nd attempt, and about 10 minutes after the 2nd failure for the 3rd attempt).
3. If all 3 notifications fail, no further retries will be made. You can then query the latest activation status via the order details interface; the same event may deliver multiple notifications due to retries, please deduplicate by eventId.
4. After receiving the successful activation notification, you can call the order details interface to retrieve the complete eSIM card information (lpa, QR code, number, etc.).