Skip to main content
WEBHOOK

Authorizations

Authorization
string
header
required

The store's API key (xfp_test_… on the sandbox, xfp_live_… on live). XFaster creates it and shows it once. An integrator key (one key for a POS company) also sends X-XFaster-Store.

Headers

X-XFaster-Signature
string
required

t=,v1=<hex HMAC-SHA256(webhook_secret, t + '.' + raw_body)>

Example:

"t=1792000000,v1=5b2e…"

X-XFaster-Event
string
required
Example:

"order.created"

X-XFaster-Event-Id
string
required

Unique per event; retries keep the same id.

Example:

"evt_01JA7Q4M8V3K2B1X9ZC5N6P0RT"

Body

application/json
event
string
Example:

"order.created"

event_id
string
Example:

"evt_01JA7Q4M8V3K2B1X9ZC5N6P0RT"

occurred_at
string<date-time>
order_id
integer
Example:

183761

url
string

GET /orders/{id} of this order, if you want it again.

Example:

"https://apps.xfaster.net/api/partner/v1/orders/183761"

store_id
integer

The store of the order (tells an integrator key's stores apart).

Example:

64

order
object | null

The full order, exactly as GET /orders/{id} returns it at the moment of the event, in your key's language. null only if it could not be built: then fetch it by url.

Response

200

Answer any 2xx within 5 seconds