Webhooks & Asynchronous Events

Overview

Open Platform forwards G-Link hotel asynchronous events to the single webhook_url configured for your application. Verify every delivery, deduplicate it, then update local order data.

Endpoint and verification

FCG sends POST requests to your configured webhook URL. The receiver must accept application/json and verify the HMAC-SHA256 signature before processing.

Header	Use
`X-OP-App-Key`	Open Platform application identifier.
`X-OP-Webhook-Event-Id`	Unique delivery identifier.
`X-OP-Webhook-Type`	Same value as `event_type`.
`X-OP-Timestamp`, `X-OP-Nonce`	Delivery timestamp and replay-protection nonce.
`X-OP-Sign-Method`, `X-OP-Sign`	`HMAC_SHA256` and its signature.

Event types

glink.hotel.order_status — booking confirmation, rejection, cancellation result; use coOrderCode and fcOrderCode to locate the order. Status: 3 confirmed, 4 rejected, 6 cancellation succeeded, 7 cancellation failed.
glink.hotel.guarantee_refund — guarantee refund or charge notification.
glink.hotel.invoice_status — invoice status and electronic invoice URLs where available.
glink.hotel.checkout_status — early checkout and refund workflow status.

Processing rules

Verify the signature and reject deliveries that fail verification.
Deduplicate by idempotency_key (and retain event_id).
Persist the delivery before updating the local order, invoice, or refund state.
Return a successful response such as {"status":"success"} after successful handling.
Use Query order details only as low-frequency compensation if an expected order-status event does not arrive; do not poll continuously.

Required setup before production

Provide the production webhook URL, its publicly reachable IP/DNS and TLS requirements, the environments it accepts, and the operations contact for delivery failures. Keep sandbox and production data separate.