Instructions

Upgrade Notice (November 2025):
DragonPass Push Event has been upgraded to Version 2.

The legacy Version 1 Push Event will remain operational until all clients complete the migration.

For upgrade assistance or technical guidance, please contact DragonPass.

Authentication

All DragonPass push events are signed using RS256 JWT.

The RSA key pair can be generated either by DragonPass or by the client. If the client generates the key pair, the private key must be securely shared with DragonPass, while the public key is used for signature verification.

Clients are responsible for validating the signature to ensure the authenticity and integrity of the callback message.

The iss (issuer) field in the JWT payload is always set to dragonpass.

Callback Key Management

The DragonPass API platform supports the following features for managing callback keys across different scenarios:

Different URLs can be configured for different callback events.

Each events supports a maximum of 2 key sets.

Typically, the previous key and the next key will have a 1-2 week overlapping period. During the overlap, the platform will randomly use one to send the callback.

Clients can use the kid in the JWT header to select the corresponding key for decryption. This rotation mechanism ensures a smooth transition while improving callback security.

The Key ID in the JWT header has the following format:

Retry Mechanism

Each push will be retried up to 3 times (total 4 attempts) until success, with the following intervals:

Initial attempt

30 seconds later

5 minutes later

10 minutes later

Outbound IP

PROD

18.135.78.82

3.9.162.122

Sandbox

18.169.203.228

Version 1 (Legacy)

Message Example

{
    "orderId": "DP00000000000001",
    "programId": "1888000000000001",
    "membershipId": "8888000066668888",
    "module": 1,
    "category": 1,
    "status": 1,
    "orderCreatedDate": "2024-12-31T00:00:00+00:00",
    "usageDate": "2024-12-31T00:00:00",
    "orderCancelledDate":"",
    "transportHubId": "A10045",
    "transportHubName": "Gatwick Airport",
    "resourceId": "N00129",
    "resourceName": "No1 Gatwick North",
    "passengers": {
        "cardholder": 1,
        "guests": 1
    }
}

Field Descriptions

Column	Description	Example
orderId	Unique identifier of the order, generated by DragonPass each time a user utilizes their Membership or E-pass.	DP00000000000001
programId	Unique identifier of the program. Assigned by DragonPass when a new program was onboarded.	1888000000000001
membershipId/ePassId	Unique ID for the DragonPass Membership or E-pass	8888000066668888
module	Specifies the module associated with the order(s), e.g. "Lounge", "Fast Track".	1
category	Specifies the category of orders, e.g. "Walk-in", "Prebooking". `1 - Walk-in` `2 - Prebooking`	1
status	Order status. `1 - Order Created` `2 - Order Cancelled`	1
orderCreatedDate	Specifies the date and time when an order was created (in UTC+0).	2024-12-31T00:00:00+00:00
usageDate	Specifies the date and time when an order was redeemed (in local time).	2024-12-31T00:00:00
orderCancelledDate	Specifies the date and time when an order was cancelled (if applicable, in UTC+0).	2024-12-31T00:00:00+00:00
transportHubId	Unique ID for the transport hub.	A10045
transportHubName	Name of the transport hub.	Gatwick Airport
resourceId	Unique ID for the DragonPass product.	N00129
resourceName	Name of the DragonPass resource.	No1 Gatwick North
cardholder	Specifies the number of cardholder.	1
guests	Specifies the number of guests.	1

Key Differences

Compared with V1, Push Event V2 introduces several enhancements:

A new eventType field has been added in the message to clearly indicate the type of event.

ePassId and membershipId are now unified into a single identifier dpId for consistency.

Expanded support to more walk in modules, including Set Meal and Coupon redemption.

The usageDate field now includes time zone information for greater accuracy.

Update the status enumeration values in the push notification to align with the order status enumeration used in the API response, i.e., 2 = Order Created and 3 = Order Cancelled.

Authentication#

Callback Key Management#

Retry Mechanism#

Outbound IP#

Version 1 (Legacy)#

Message Example#

Field Descriptions#

Key Differences#

Authentication

Callback Key Management

Retry Mechanism

Outbound IP

Version 1 (Legacy)

Message Example

Field Descriptions

Key Differences