Webhooks
An order event, delivered to your endpoint
One attempt, 8 second timeout, redirects not followed. Check X-SitesPlaced-Signature before trusting the body: it is sha256= followed by the hex HMAC-SHA256 of the raw body, made with the whsec_… secret shown once when the endpoint was created. Compare in constant time.
postWebhookorderEvent
Headers
X-SitesPlaced-Event'order.created' | 'order.paid' | 'order.confirmed' | 'order.fulfilled' | 'order.shipped' | 'order.out_for_delivery' | 'order.completed' | 'order.cancelled' | 'order.updated' required
X-SitesPlaced-Deliverystring required
X-SitesPlaced-Signaturestring required
sha256=<hex HMAC-SHA256 of the raw body>
Payload
object required
Response
Answer with any 2xx status within 8 seconds.
Changes
Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.