Add an endpoint
- Press New endpoint.
- Enter the URL. It must be HTTPS and reachable on the internet. Private and local addresses are refused.
- Tick the events you want. The event list has the body of each one.
- Press Add endpoint.
- Copy the signing secret it shows. It is shown once. Rotate secret makes a new one.
webhook.ping event right away so you can check your endpoint.
What your endpoint receives
Each event is aPOST with a JSON body:
2xx within 10 seconds. StockShift does not follow redirects.
An event can arrive more than once and out of order. Retries keep the same id, so store it and skip events you have already handled.
Check the signature
Check theStockShift-Signature header before you trust the body. It looks like t=1760000000,v1=5257a8...:
tis the Unix time the event was sent.v1is the HMAC-SHA256 of<t>.<raw body>under the endpoint’s signing secret, in hex.
t more than five minutes old. Every SDK has a helper that does all of this:
Retries
A delivery that gets anything other than a2xx is tried again after 1, 5, 30, 120, 360 and 720 minutes. If it still fails, or 24 hours pass, the delivery is marked failed, the endpoint is disabled and the organization’s owners get an email. Events that happen while an endpoint is disabled are not sent later.
The Deliveries card on an endpoint lists its latest 50 deliveries with their status, response code, time taken and attempts. Retry sends a failed delivery once more. Deliveries are kept for 30 days.
To pause an endpoint, untick Enabled and press Save endpoint.