Skip to main content
WEBHOOK

Authorizations

Sodacards-Signature
string
header
required

t=<unix>,v1=<hex hmac-sha256> over "<t>.<raw-body>", keyed on the endpoint's whsec_ signing secret. Verify it before trusting a delivery.

Headers

Sodacards-Event-Id
string
required

The event id. Stable across retries; de-duplicate on it.

Sodacards-Event-Type
string
required

The event type, e.g. order.fulfilled.

Body

application/json
id
string
required

Event id, stable across retries.

Example:

"evt_1a2b3c"

type
string
required

Event type.

Allowed value: "order.refunded"
created_at
string<date-time>
required

When the event occurred.

data
object
required

The order id and its status. Fetch full details, including codes, from the authenticated order endpoints; a webhook never carries a code.

Response

200

Return any 2xx to acknowledge receipt.