Webhooks API

Create webhook

POST /api/v1/webhooks
Authorization: Bearer <admin_token>

{
  "url": "https://your-app.com/webhooks/rcommerce",
  "events": ["order.paid", "order.shipped", "payment.succeeded"],
  "secret": "your-webhook-secret"
}

List webhooks

GET /api/v1/webhooks
Authorization: Bearer <admin_token>

Delete webhook

DELETE /api/v1/webhooks/:id
Authorization: Bearer <admin_token>

Event types

Event	Description
order.created	New order placed
order.paid	Payment confirmed
order.shipped	Fulfillment created
order.completed	Order marked complete
order.cancelled	Order cancelled
order.refunded	Refund processed
payment.succeeded	Payment confirmed
payment.failed	Payment declined
product.created	New product added
product.updated	Product modified
customer.created	New customer registered

Payload format

{
  "event": "order.paid",
  "timestamp": "2024-01-01T12:00:00Z",
  "data": {
    "order_id": "uuid",
    "order_number": "ORD-2024-001",
    "total": 150.00,
    "currency": "USD"
  }
}

Signature verification

Webhooks are signed with HMAC-SHA256. Verify the X-Webhook-Signature header:

const crypto = require('crypto');
const signature = crypto.createHmac('sha256', webhookSecret)
  .update(rawBody)
  .digest('hex');
// Compare with X-Webhook-Signature header

Retry policy

Failed webhooks are retried with exponential backoff:

• 1st retry: 1 minute
• 2nd retry: 5 minutes
• 3rd retry: 30 minutes
• Max retries: 3