Voucher redeemed webhook
Triggered when a customer’s voucher is redeemed. This event is fired when a voucher’s status changes to “redeemed”, typically as a result of the voucher being applied to a purchase.
The webhook payload includes details of the redeemed voucher and information about the user who owns the voucher.
An example of a voucher redeemed webhook
{
"id": "voucher673665",
"type": "shopper.voucher-redeemed",
"chain_id": 1781,
"created": "2026-03-10T14:42:13Z",
"data": {
"voucher_id": 673665,
"voucher_key": "b1a7722ffb0aece68b9feed3d212ef5176cb9418848856431b8b957063f466a6",
"voucher_created_datetime": "2026-02-04T13:46:21+00:00",
"voucher_type": "basket",
"voucher_status": "redeemed",
"voucher_locked": false,
"campaign_id": 1751,
"campaign_type": "loyalty",
"campaign_title": "ACME Loyalty Campaign",
"campaign_image_filename": null,
"campaign_image_url": null,
"campaign_image_link": null,
"campaign_image_dimension_x": null,
"campaign_image_dimension_y": null,
"voucher_expiry_datetime_utc": "2026-05-05T13:46:21+00:00",
"voucher_expiry_seconds_remaining": 7167848,
"creating_user": {
"user_id": 21,
"full_name": "Dave Sevenoaks"
},
"voucher_redeemed_datetime": "2026-03-10T14:33:49+00:00",
"generating_return_transaction": [],
"parent_voucher": null,
"voucher_title": null,
"voucher_text": "Your ACME Loyalty Voucher",
"voucher_description": null,
"voucher_notes": null,
"voucher_honour_code": null,
"voucher_image_url": null,
"voucher_discount_ratio": 0,
"voucher_currency_code": "EUR",
"voucher_currency_id": 2,
"voucher_currency_symbol": "\u20ac",
"voucher_amount_original": 25,
"voucher_amount_redeemed": 25,
"voucher_amount": 25,
"redeeming_basket": null,
"type": "basket",
"user": {
"id": 3814225,
"user_id": 3814225,
"first_name": "John",
"last_name": "Smith",
"address_streetname": "Dawson Street",
"address_housenumber": "22",
"address_towncity": "Dublin",
"address_postalcode": "D02 Y336",
"country_code": "IE",
"gender": "F",
"birthday": "1990-01-06T00:00:00+00:00",
"signup_channel": "spaaza-mobile-web",
"username": "john.smith@spaaza.com",
"authentication_point_identifier": null,
"auxiliary_identifier": null,
"authentication_point": null,
"mailing_list": {
"mailing_list_sub_offered": false,
"mailing_list_subscribed": true,
"printed_mailing_list_subscribed": false
},
"opt_in_programme": {
"programme_opted_in": true,
"join_date": "2025-02-17T14:21:28+00:00"
},
"obfuscated": false,
"is_influencer": false,
"address_housenumber_extension": null,
"address_line_2": null,
"address_line_3": null,
"address_regionstate": null,
"address_latitude": 53.339721,
"address_longitude": -6.258549,
"member_number": {
"type": "custom",
"code": "2000002"
},
"language": null,
"opt_in_secondary": false,
"opt_in_secondary_last_modified_date": "2025-02-17 14:21:28",
"registered": true,
"is_employee": false,
"push_notification_subscription": {
"subscribed": false,
"subscriptions": []
},
"loyalty_status": {
"campaign_id": 1751,
"name": "Gold",
"description": "Gold level in the ACME Programme",
"loyalty_level_id": 63,
"points_balance_current": 2627,
"monetary_balance_current": null,
"points_to_proceed_next_level": null,
"points_to_remain_current_level": 0,
"last_review_date": "2025-02-02T08:32:10+00:00",
"next_review_date": null,
"date_reached": "2025-02-04T13:46:19+00:00"
},
"frequency": 5,
"recency": 5,
"monetary": 3,
"overall": 553,
"stores": "College Green",
"online_shopper": true,
"offline_shopper": true,
"average_basket_value": "69.96",
"days_since_last_purchase": 1,
"number_of_purchases": 105,
"referral_channel": "store",
"referral_code": "ptola9",
"referring_user": {
"authentication_point_identifier": "2152416",
"campaign_id": 2067,
"id": 3593704,
"referral_channel": "webshop",
"referral_code": "b09zy7"
}
}
}
}
Spaaza can call an external webhook when a customer’s voucher is redeemed.
We can configure a webhook URL that you provide. Whenever the voucher-redeemed event occurs we send a simple POST request to the URL. The body of the POST is JSON that includes details of the event and the voucher that triggered it. So that you can verify that the POST really originates from Spaaza we provide a signature in a request header (X-Spaaza-Hmac-SHA256).
The value of the header is a base 64 encoded HMAC-SHA256 of the whole body of the request with a shared secret that we would provide. Your code to handle the event should recreate the signature using the shared secret and compare it to the value in the header.