Skip to main content
WEBHOOK

Headers

webhook-id
string<uuid>
required

Stable event identifier matching body.id. Deduplicate by this identifier; the event body and occurred_at remain unchanged across retries. Delivery may be duplicated or arrive out of order.

webhook-timestamp
string
required

Unix seconds for this delivery attempt. Verify with a 5-minute tolerance; the timestamp changes on each retry.

Pattern: ^[0-9]+$
webhook-signature
string
required

Space-delimited Standard Webhooks signatures, each v1,<base64 signature>. Before processing, verify HMAC-SHA256 over webhook-id + "." + webhook-timestamp + "." + the raw request body using the base64-decoded whsec_ signing secret.

Body

application/json

Thin event envelope: stable id, event type, occurred_at, team_uuid and resource identifiers in data. Full payloads are not offered in this version. A future full-payload option must be explicitly selected; existing thin subscriptions retain their documented meaning.

id
string<uuid>
required

Stable event UUID, also sent in webhook-id. Duplicate deliveries keep the same id.

team_uuid
string<uuid>
required

Resource UUID.

occurred_at
string<date-time>
required

When the business event occurred; distinct from the delivery-attempt timestamp.

type
enum<string>
required
Available options:
shipment.booked,
shipment.failed,
shipment.cancelled,
shipment.voided
data
object
required

Response

Event durably accepted. Acknowledge with any 2xx within 10 seconds; a non-2xx response or timeout triggers retries with backoff for up to 24 hours.