---
title: "An order event, delivered to your endpoint"
method: POST
path: "orderEvent"
tags: ["Webhooks"]
---

# An order event, delivered to your endpoint

`POST orderEvent` (webhook)

One attempt, 8 second timeout, redirects not followed. Check `X-SitesPlaced-Signature` before trusting the body: it is `sha256=` followed by the hex HMAC-SHA256 of the raw body, made with the `whsec_…` secret shown once when the endpoint was created. Compare in constant time.

## Headers

- `X-SitesPlaced-Event` 'order.created' | 'order.paid' | 'order.confirmed' | 'order.fulfilled' | 'order.shipped' | 'order.out_for_delivery' | 'order.completed' | 'order.cancelled' | 'order.updated', required
- `X-SitesPlaced-Delivery` string, required
- `X-SitesPlaced-Signature` string, required

## Payload

- object

## Acknowledgement `200`

Answer with any 2xx status within 8 seconds.

---

[API](https://skmtc.dev/sitesplaced/apis/sitesplaced-developer-api.md) · [All operations](https://skmtc.dev/sitesplaced/apis/sitesplaced-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sitesplaced/apis/sitesplaced-developer-api/revisions/66fbfbbaad1a?raw)