---
title: "order.updated"
method: POST
path: "order.updated"
tags: ["Webhooks"]
---

# order.updated

`POST order.updated` (webhook)

An order changed status or progress. Signed with `Spoofy-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, "<t>.<body>")>`, the event id in `Spoofy-Event-Id` (until 2026-11-18, also under the header names used before 2026-10-18). Answer 2xx within 10 s; anything else is retried with backoff for about 24 h.

## Payload

- WebhookEvent
  - `id` string, required: Event id; also in the Spoofy-Event-Id header. Use it to drop duplicates.
  - `type` 'order.updated' | 'deposit.credited' | 'balance.low' | 'automation.updated', required
  - `created` integer, required: Unix seconds.
  - `data` object, required

## Acknowledgement `200`

Received.

---

[API](https://skmtc.dev/spoofy/apis/spoofy-api.md) · [All operations](https://skmtc.dev/spoofy/apis/spoofy-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spoofy/apis/spoofy-api/revisions/58adc986f826?raw)