# Callbacks

When initiating a payment session through Inbank Partner API, the e-shop provides three URLs:

- <b>redirectUrl</b> - the URL to which the customer's browser is redirected after completing the credit application flow, regardless of its outcome.
- <b>cancelUrl</b> - the URL to which the customer's browser is redirected if the customer chooses to cancel the flow, or if the credit application or contract is cancelled before the flow is completed.
- <b>callbackUrl</b> - the URL to which Inbank sends server-to-server callback notifications.


Once the financing process is finalized, Inbank sends the final callback through the customer's browser to `redirectUrl` and server-to-server to `callbackUrl`. The browser callback is not guaranteed to arrive if the customer does not press the "<b>back to merchant</b>" button, or if connectivity or technical problems occur on the customer's device or browser. The browser and server-to-server callbacks may arrive in either order.

If the same callback event is delivered more than once, process only the first delivery. Distinct callback events for the same payment session must be processed separately.

The e-shop should process incoming callbacks as follows:

- Validate the callback using the [Callback authenticity validation](#callbackauthenticityvalidation) procedure.
- Identify the POS session using the `uuid` from the callback.
- Inspect the callback status and update the order accordingly. When necessary, retrieve the latest POS session, credit application, or credit contract details and verify the purchase reference.