/admin/api/v1/settings/webhooks (CRUD, plus POST /{id}/rotate-secret,
POST /{id}/test, and GET /{id}/deliveries).
Delivery model
- At-least-once. Deliveries are written to a durable outbox and posted by
a worker every minute. Dedupe on the delivery
idif you must process exactly once. - Retries with backoff — roughly 1m, 5m, 30m, 2h, 6h — then the delivery is marked failed. Per-endpoint history is visible on the Developers page.
- Sandbox vs live — sandbox-mode endpoints receive sandbox events only; live endpoints receive live events.
Payload
data.shipment_ref and
data.external_code alongside data.consignment_id, so you can correlate on
your own references without a lookup.
Subscribing
Subscriptions are exact event types or category wildcards (manifest.*). An
empty subscription list subscribes to everything.
Verify signatures
Every delivery is HMAC-signed. Always verify before trusting a payload.