Webhook Payload Reference

• Method: HTTPS POST to your endpoint (plain HTTP is rejected).
• Content-Type: application/json — the body is a single JSON object.
• Authentication: HMAC-SHA256 signature in X-ResultsZA-Signature (verify against the raw body). Authenticate with the signature, not the source IP. If you need a fixed source IP for a firewall allowlist, contact us.
• Acknowledge: return any 2xx (200, 201, 202 or 204 are all treated as success) within 10 seconds. The response body can be empty and needs no particular Content-Type.
• On failure: a non-2xx response, a timeout, or an unreachable endpoint is retried up to 3 times, 10 minutes apart, then marked failed (you get an email and a Delivery Log entry).
• Delivery: at-least-once and not strictly ordered — de-duplicate per draw (see Building your listener for the per-game key).
• Payload size: most deliveries are a few KB; horse racing is the largest (a full race day across venues can reach tens of KB). There is no fixed cap, so don't set your request-body limit too low.
• Stability: the payload is unversioned and changes are additive only. New fields may be added over time, so ignore unknown fields rather than failing on them.

Content-Type: application/json
X-ResultsZA-Signature: sha256=<hmac_hex>
X-ResultsZA-Game: lotto
X-ResultsZA-Event: result.published

Test payloads sent from the settings page use "event": "result.test".

{
  "event": "result.published",
  "game": "<game_id>",
  "country": "<ISO country code>",
  "dispatched_at": "2026-06-25T21:05:00Z",
  "data": { ... }
}

The data object varies by game, see each section below.

Your endpoint needs to do three things: accept an HTTPS POST, verify the signature against the raw request body, and return a 2xx response within 10 seconds.

Endpoint requirements

• Reachable over HTTPS (plain HTTP is rejected).
• Returns a 2xx status within 10 seconds, otherwise the delivery is treated as failed and retried.
• Do slow work (database writes, downstream calls) after you respond, not before.

Verify the signature

Verify against the raw request bytes, exactly as received. If your framework parses the JSON and you then re-serialise it, the bytes change and the signature will never match. The header value includes the sha256= prefix, so compare against the full string.

Python (Flask):

import hmac, hashlib
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = b"your_webhook_secret"          # from Push Settings

@app.post("/webhooks/resultsza")
def resultsza():
    body = request.get_data()            # raw bytes, before any parsing
    expected = "sha256=" + hmac.new(SECRET, body, digestmod=hashlib.sha256).hexdigest()
    received = request.headers.get("X-ResultsZA-Signature", "")
    if not hmac.compare_digest(expected, received):
        abort(403)
    event = request.get_json()
    # de-dupe on event["game"] + event["data"].get("draw_date") before processing
    return "", 200

Node (Express):

const express = require("express");
const crypto = require("crypto");
const app = express();
const SECRET = "your_webhook_secret";    // from Push Settings

// express.raw keeps the body as bytes so the signature verifies byte-for-byte
app.post("/webhooks/resultsza",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const expected = "sha256=" +
      crypto.createHmac("sha256", SECRET).update(req.body).digest("hex");
    const received = req.get("X-ResultsZA-Signature") || "";
    if (expected.length !== received.length ||
        !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received))) {
      return res.sendStatus(403);
    }
    const event = JSON.parse(req.body.toString("utf8"));
    // de-dupe on event.game + event.data.draw_date before processing
    res.sendStatus(200);
  });

Delivery is at-least-once

Treat every delivery as at-least-once and not strictly ordered. The same result can arrive more than once (for example, if your endpoint is slow and a retry overlaps a late success), so make processing idempotent. De-duplicate per game using a key that is unique per draw:

• SA Lottery: game + data.draw_number (or data.draw_date).
• Nigeria (Baba Ijebu) and Ghana: game + data.draw_date + data.draw_time — these run several draws per day, so the date alone is not unique.
• Kenya, UK 49s, EuroMillions, Irish Lotto, US: game + data.draw_date (each draws at most once per day).
• Horse racing: data.race_date — a full day across all venues is sent as a single horse_racing payload, so there is only ever one delivery per date.

Retries

A non-2xx response or a timeout is retried up to 3 times, 10 minutes apart. After the final failure the delivery is marked failed, you receive an email, and it appears in the Delivery Log on your Push Settings page.

Monitoring deliveries

Every dispatch is recorded in the Delivery Log in your portal (Push Settings › Delivery Log). It lists your recent deliveries (paginated, retained for 15 days) with the game, draw date, status (delivered / failed / pending), attempt count, last attempted time and delivered at time, so you can confirm exactly what we sent and diagnose any failures on your side without contacting support.

Format: string = comma-separated e.g. "4, 11, 23" — integer array = JSON array e.g. [3, 17, 28]

{
  "event": "result.published",
  "game": "dailylotto",
  "country": "ZA",
  "dispatched_at": "2026-06-25T18:48:26Z",
  "data": {
    "draw_number": "2657",
    "draw_date": "2026-06-24",
    "winning_numbers": "05, 07, 19, 24, 35",
    "bonus_ball": null,
    "jackpot": 380000,
    "divisions": [
      { "division": "DIV 1", "match": "MATCH 5", "winners": 2,     "prize": 177684.8 },
      { "division": "DIV 2", "match": "MATCH 4", "winners": 327,   "prize": 310.5 },
      { "division": "DIV 3", "match": "MATCH 3", "winners": 9046,  "prize": 16.8 },
      { "division": "DIV 4", "match": "MATCH 2", "winners": 85994, "prize": 4.7 }
    ]
  }
}

{
  "event": "result.published",
  "game": "premier 06",
  "country": "NG",
  "dispatched_at": "2026-06-25T18:50:04Z",
  "data": {
    "draw_date": "2026-06-23",
    "draw_time": "12:45",
    "numbers": [35, 85, 88, 8, 57]
  }
}

{
  "event": "result.published",
  "game": "ghana monday special",
  "country": "GH",
  "dispatched_at": "2026-06-25T18:53:14Z",
  "data": {
    "draw_date": "2026-06-23",
    "draw_time": "20:00",
    "numbers": [43, 32, 45, 77, 11]
  }
}

{
  "event": "result.published",
  "game": "kenya lotto monday",
  "country": "KE",
  "dispatched_at": "2026-06-25T18:53:14Z",
  "data": {
    "draw_date": "2026-06-22",
    "draw_time": "23:00",
    "winning_numbers": "12, 21, 22, 29, 36, 37"
  }
}

{
  "event": "result.published",
  "game": "uk49s brunchtime",
  "country": "GB",
  "dispatched_at": "2026-06-25T15:05:00Z",
  "data": {
    "draw_date": "2026-06-25",
    "winning_numbers": "7, 10, 11, 17, 26, 35",
    "booster_ball": 49
  }
}

{
  "event": "result.published",
  "game": "euromillions",
  "country": "EU",
  "dispatched_at": "2026-06-25T18:53:16Z",
  "data": {
    "draw_date": "2026-06-23",
    "winning_numbers": "3, 33, 36, 45, 46",
    "lucky_star_1": 5,
    "lucky_star_2": 6,
    "jackpot": 47884519.6
  }
}

Draws every Tuesday and Friday at ~21:00 CET (23:00 SAST in summer).

{
  "event": "result.published",
  "game": "irish lotto",
  "country": "IE",
  "dispatched_at": "2026-06-27T19:05:11Z",
  "data": {
    "draw_date": "2026-06-27",
    "winning_numbers": "12, 27, 29, 38, 43, 46",
    "bonus_ball": 25,
    "jackpot": 5181046.0
  }
}

Draws every Wednesday and Saturday at ~18:45 UTC (20:45 SAST).

{
  "event": "result.published",
  "game": "us powerball",
  "country": "US",
  "dispatched_at": "2026-06-25T18:58:32Z",
  "data": {
    "draw_date": "2026-06-24",
    "winning_numbers": "13, 14, 16, 21, 38",
    "special_ball": 14,
    "multiplier": 2
  }
}

us powerball: Mon / Wed / Sat. us mega millions: Tue / Fri. Results arrive ~05:00 SAST the morning after the draw.

{
  "event": "result.published",
  "game": "horse_racing",
  "country": "ZA",
  "dispatched_at": "2026-06-25T19:14:32Z",
  "data": {
    "race_date": "2026-06-25",
    "meetings": [
      {
        "venue": "Vaal",
        "track_code": "V",
        "province": "G",
        "races": [
          {
            "race_no": 1,
            "race_name": "Maiden Juvenile Plate",
            "race_class": "MJP",
            "distance": 1200,
            "going": "g",
            "off_time": "12:00:00",
            "win_time": 69.26,
            "stake_total": 125000,
            "finishers": [
              {
                "finish": 1,
                "horse_name": "Summerfest",
                "jockey": "C Zackey",
                "trainer": "SG Tarry",
                "tote_win": 6.9,
                "tote_place": 1.8,
                "sp": "8/1"
              },
              {
                "finish": 2,
                "horse_name": "Molten Rock",
                "jockey": "G Lerena",
                "trainer": "JAJ v Vuuren",
                "tote_win": null,
                "tote_place": 1,
                "sp": "87/100"
              },
              {
                "finish": 3,
                "horse_name": "Vision Of Gold",
                "jockey": "C Murray",
                "trainer": "Mike / Mathew de Kock",
                "tote_win": null,
                "tote_place": 1.9,
                "sp": "11/2"
              }
            ],
            "dividends": [
              { "bet_type": "Exacta",   "selections": "10/8",      "dividend": 13.9 },
              { "bet_type": "Swinger",  "selections": "10/11",     "dividend": 4.2 },
              { "bet_type": "Trifecta", "selections": "10/8/11",   "dividend": 65.6 },
              { "bet_type": "Quartet",  "selections": "10/8/11/4", "dividend": 801 }
            ]
          }
        ]
      }
    ],
    "races_scraped": 9,
    "dividends_found": 74
  }
}