Loan Webhooks

QFAST notifies your system when a loan is created and when it becomes active.

Every request includes an HMAC-SHA256 signature in the Signature header. Verify it before processing — see Webhook Security.

Event: `loan.submitted`

Fired after a successful Submit Loan call. Confirms the loan has been created.

Field	Type	Description
`event`	String	Always `loan.submitted`.
`timestamp`	String	Event time in ISO 8601 format (e.g., `2026-05-11T13:03:04+07:00`).
`data.loan_id`	UUID	QFAST loan identifier.
`data.reference_account_number`	String	Your reference number.
`data.status`	String	Loan status — always `pending` on creation.
`data.principal_amount`	String (decimal)	Principal in IDR (e.g., `"5000000.00"`).
`data.interest_amount`	String (decimal)\|null	Total interest in IDR (e.g., `"750000.00"`).
`data.admin_fee_amount`	String (decimal)\|null	Admin fee in IDR (e.g., `"50000.00"`).
`data.reserve_amount`	String (decimal)	Reserve amount in IDR (e.g., `"500000.00"`).
`data.term_unit`	String	Loan term unit (`day`, `week`, or `month`).
`data.term_length`	Integer	Loan duration. Equals the number of `repayment_schedules`. Unit is given by `term_unit`.
`data.penalty_rate`	String	Daily late penalty rate as a string.
`data.start_date`	String\|null	Loan start date in `YYYY-MM-DD`.

Fired after a successful Update Loan call. The loan stays in pending status.

Same as loan.submitted — see table above — with event = loan.updated and status = pending.

Fired when a loan transitions to active status (e.g., after disbursement completes).

Same as loan.submitted — see table above — with status = active.