Configure journey completion notifications

​

Prerequisites

• Notification settings are enabled for your organisation. If the Notification settings tab is not displayed in Settings, contact your GBG representative.
• You are logged in to GBG GO with a role that has permission to read notification settings.

​

How notifications work

​

Add a notification setting

1. In GBG GO, click Settings.
2. Click the Notification settings tab.
3. Click New setting. The Add notification setting dialog is displayed.
   • Name: A name that identifies where the notifications are sent, for example Fraud-ops endpoint.
   • Endpoint URL: The public HTTPS endpoint that receives the notifications.
   • Authentication: The authentication method your endpoint requires. Select either None, Basic auth, or API key.
     • None: GBG GO sends no authentication credentials.
     • Basic auth: Enter the Username and Password your endpoint expects.
     • API key: Enter the Key, and the Header name to send it in. The header name defaults to Authorization. You cannot use x-gbg-signature or content-type as the header name.
4. Click Save setting.

​

Connect a notification setting to a journey

{
  "resourceId": "your-journey-resourceId@latest",
  "context": {
    "config": {
      "delivery": "api",
      "notification": {
        "resource": "your-notification-resourceId@1"
      }
    }
  }
}

​

Send a test notification

1. In GBG GO, click Settings.
2. Click the Notification settings tab.
3. On the row of the setting you want to test, click the three dots, then click Send test. The Test dialog is displayed, showing the request that GBG GO sends.
4. Review the request body and headers.
5. Click Send test request.

• Response: The body your endpoint returned. If the request did not reach your endpoint, the body explains why instead.
• Headers: The headers your endpoint returned.
• Request sent: The request GBG GO sent, so that you can compare it with what your endpoint received.

​

Edit a notification setting

1. In GBG GO, click Settings.
2. Click the Notification settings tab.
3. On the row of the setting you want to change, click the three dots, then click Edit. The Edit notification setting dialog is displayed.
4. Change the Name, Endpoint URL, or Authentication method.
5. Click Save setting.

1. Edit the setting and click Save setting.
2. View the signing secret for the new version. For the steps, see View the signing secret.
3. Configure your receiving system to accept both the previous secret and the new one.
4. Update your start request to the new version.
5. Once no journeys reference the previous version, stop accepting the previous secret.

​

Archive a notification setting

1. In GBG GO, click Settings.
2. Click the Notification settings tab.
3. On the row of the setting you want to archive, click the three dots, then click Archive. The Archive notification setting dialog is displayed.
4. Click Archive to confirm.

​

Notification payload

{
  "schemaVersion": "1",
  "eventType": "journey.completed",
  "instanceId": "P7U7Licy40cLZiENe8MrsL",
  "status": "Completed",
  "region": "EU",
  "deliveryId": "8113f586-4c21-4f7a-9d3e-2b6f0a1c5e94",
  "idempotencyKey": "P7U7Licy40cLZiENe8MrsL:8113f586-4c21-4f7a-9d3e-2b6f0a1c5e94:journey.completed",
  "occurredAt": "2026-08-07T15:08:56.655Z"
}

​

View the signing secret

1. In GBG GO, click Settings.
2. Click the Notification settings tab.
3. On the row of the setting you want to view, click the three dots, then click View signing secret. The Signing secret dialog is displayed with the secret hidden.
4. Click the eye icon to reveal the secret, or click Copy to copy it to your clipboard.

​

Verify a notification

X-GBG-Signature: sha256=3a7bd3e2360a3d29eea436fcfb7e44c735d117c42d1c1835420b6b9942dd4f1b

1. Compute the HMAC-SHA256 of the raw request body using your signing secret, and encode the digest as lowercase hexadecimal.
2. Strip the sha256= prefix from the X-GBG-Signature header to get the expected digest.
3. Compare your computed digest with the expected digest, using a constant-time comparison function.
4. Reject the request if the digests do not match.

​

Delivery behaviour

​

Recommended integration pattern

• Accept HTTPS POST requests on a publicly reachable URL.
• Serve the notification directly at that URL, without a redirect. GBG GO does not follow redirects, so a proxy or an HTTP to HTTPS redirect in front of your endpoint stops the notification from arriving.
• Verify the X-GBG-Signature header before processing anything.
• Return 200 OK within 15 seconds. GBG GO waits 15 seconds for a response before it treats the attempt as failed.
• Queue the work rather than processing it while GBG GO waits.
• Log the deliveryId so that you can trace a delivery.

1. Use the idempotencyKey to check whether you have already processed the notification.
2. Call Fetch journey state with the instanceId to retrieve the completed journey.
3. Process the result.