Rassmi Developers

Webhooks

Webhooks Overview

Webhooks push each change in the store to your server as it happens: a new order, an agent's confirmation, a shipment, a stock move.

How it works

  1. Register an endpoint

    An HTTPS address of yours, with the events it wants (["*"] for all). Up to 5 endpoints per store. See Register Webhook.

  2. Rassmi sends a POST

    A JSON body with the event and its data, signed with the endpoint's secret.

  3. Your server answers 2xx

    Within 3 seconds; do slow work afterwards, from a queue. Any other answer, a redirect or a timeout is retried.

Headers of a delivery

HeaderValue
X-Rassmi-EventThe event, as order.confirmed.
X-Rassmi-Signaturesha256= + the HMAC-SHA256 of the raw body with the endpoint's secret. See Signature Verification.
X-Rassmi-DeliveryThe delivery's ID, the same on every retry: use it to process each delivery once.
Content-Typeapplication/json

Good practice

  • Verify the signature before reading the body.
  • Answer fast, then process: a slow endpoint times out and gets the delivery again.
  • Deduplicate on X-Rassmi-Delivery: a delivery can arrive more than once.
  • Do not rely on order: read data.updated_at, or fetch the order with GET /orders/{order}, before overwriting newer data.