Webhooks for Poland orders & invoices
Subscribe to order.*, invoice.* (via KSeF) and shipment.* events. Signed HMAC-SHA256, retried 6×, replay-protected with X-Corp-Timestamp.
Event catalogue
order.accepted, order.confirmed, order.in_production, order.shipped, order.delivered, order.cancelled, invoice.issued, invoice.paid, invoice.credit_note (all via KSeF for VAT 23% in Poland), shipment.label_created, shipment.eta_changed, catalog.updated. Each event includes event_id, event_type, occurred_at, data{…}.
Signing & verification
Header X-Corp-Signature: t=
Retries & dead-letter
On non-2xx response: retry at 1m, 5m, 15m, 1h, 6h, 24h (six attempts total over ~31 hours). After exhaustion, subscription pauses and email alert sent to registered ops contact. Dead-letter events available via GET /v1/webhooks/{id}/dead_letter for 30 days; manual replay via POST /v1/webhooks/{id}/replay/{event_id}.
FAQ
What HTTP method and content-type?
POST application/json. Always UTF-8. We send Content-Length and Content-Encoding: identity (no gzip on requests by default).
Can I have multiple endpoints?
Yes — up to 10 active subscriptions per account, each can filter by event_type prefix (e.g. invoice.*). Useful to split traffic between ERP and observability tooling.
What if my endpoint is briefly unavailable?
Retries cover ~31 hours; brief outages absorbed transparently. For longer outages, replay dead-letter events when you recover.
Are events ordered?
Events for the same resource (order_id) delivered in causal order on a best-effort basis (no guarantee). Use occurred_at + event_id to reconstruct order client-side if strict ordering required.
How do I rotate the signing secret?
POST /v1/webhooks/{id}/rotate_secret — returns the new secret; the old one remains valid for 24 hours for grace period.