Understand webhooks and PCI DSS compliance

Not all external systems you integrate with Oracle Commerce will comply with the Payment Card Industry Data Security Standard (PCI DSS).

For example, while your order management system will likely comply with PCI DSS, systems that manage services like email marketing or customer loyalty programs might not be compliant.

Oracle Commerce provides three webhooks that exclude payment details from the order data you send to systems that do not comply with PCI DSS:

Order Submit Without Payment Details fires when an order has been successfully submitted by a customer or an agent.
Return Request Update Without Payment Details fires when a return request has been successfully processed by an agent.
Return Request Validation Without Payment Details queries an external system to determine whether an order is returnable.

Important: Oracle Commerce does not verify that systems to which you send webhook notifications comply with PCI DSS. You are responsible for determining if target systems are compliant. If you know for sure the target system does not comply with PCI DSS, or if you are unsure whether it does, use the versions of the webhooks Without Payment Details.

The following table describes all the components of the paymentGroups object that are excluded from the request for non-PCI compliant versions of the webhooks.

paymentGroups Component	Description
`authorizationStatus`	An array of authorization status objects.
`token`	The payment token string. This component is valid only if the `paymentGroupClassType` is `tokenizedCreditCard`.
`expirationMonth`	The two-digit credit card expiration month. This component is valid only if the `paymentGroupClassType` is `tokenizedCreditCard`.
`expirationYear`	The four-digit credit card expiration year. This component is valid only if the `paymentGroupClassType` is `tokenizedCreditCard`.
`paymentGroupClassType`	The class type of the payment group. Valid values are `tokenizedCreditCard` or `externalPaymentGroup`.
`creditCardNumber`	The last four digits of the credit card number. This component is valid only if the `paymentGroupClassType` is `tokenizedCreditCard`.
`submittedDate`	The date the payment was submitted.

The following example shows the paymentGroups portion of an Order Submit webhook POST request.

"paymentGroups": [{
            "id": "pg30411",
            "amount": 277.97,
            "authorizationStatus": [{
                "amount": 277.97,
                "errorMessage": "Request was processed successfully.",
                "authorizationDecision": "ACCEPT",
                "transactionId": "bupovkdslhd8or1i869pj1bls",
                "reasonCode": "100",
                "transactionUuid": "75afb7640b5a43e88341572869adbda6",
                "transactionSuccess": true,
                "currency": "USD"
            }],
            "currencyCode": "USD",
            "token": "9997000108950573",
            "expirationMonth": "02",
            "expirationYear": "2019",
            "paymentGroupClassType": "tokenizedCreditCard",
            "creditCardNumber": "1111",
            "submittedDate": "2015-12-16T10:25:41.894Z",
            "billingAddress": {
                "middleName": null,
                "lastName": "Shopper",
                "ownerId": null,
                "state": "NY",
                "address1": "100 MyStreet Ave",
                "address2": null,
                "address3": null,
                "companyName": null,
                "suffix": null,
                "country": "US",
                "city": "MyTown",
                "faxNumber": null,
                "postalCode": "13202",
                "phoneNumber": "212-555-0100",
                "email": "shopper@example.com",
                "county": null,
                "prefix": null,
                "firstName": "Sally",
                "jobTitle": null
            },
            "amountAuthorized": 277.97,
            "paymentMethod": "tokenizedCreditCard"
        }]

The following example shows the paymentGroups portion of an Order Submit Without Payment Details webhook POST request.

"paymentGroups": [{
            "id": "pg30411",
            "amount": 277.97,
            "billingAddress": {
                "middleName": null,
                "lastName": "Shopper",
                "ownerId": null,
                "state": "NY",
                "address1": "100 MyStreet Ave",
                "address2": null,
                "address3": null,
                "companyName": null,
                "suffix": null,
                "country": "US",
                "city": "MyTown",
                "faxNumber": null,
                "postalCode": "13202",
                "phoneNumber": "212-555-0100",
                "email": "shopper@example.com",
                "county": null,
                "prefix": null,
                "firstName": "Sally",
                "jobTitle": null
            },
            "amountAuthorized": 277.97,
            "paymentMethod": "tokenizedCreditCard"
        }]