Skip to main content
WEBHOOK

Authorizations

Authorization
string
header
required

Token returned by POST /auth/token, sent as Authorization: Bearer <token>.

Headers

X-Webhook-Event
enum<string>
required

Name of the event (orderUpdated, orderFulfilled, shippingUpdated, inventoryMovement, replenishmentStatus, replenishmentCreated, replenishmentScheduled). Route on this header, not on the URL: all feeds can share one endpoint. Treat a request without this header as an order event.

Available options:
orderUpdated,
orderFulfilled,
shippingUpdated,
inventoryMovement,
replenishmentStatus,
replenishmentCreated,
replenishmentScheduled
X-Cubbo-Webhook-Message-Id
string<uuid>
required

UUID of this delivery attempt. It is part of the signed string. A new value is generated on every attempt, so a retry of the same event carries a different message id.

X-Cubbo-Hmac-SHA256
string
required

Lowercase hex HMAC-SHA256 of the string <message id>.<isa>.<exp>.<raw request body> computed with your webhook secret. Verify it against the exact bytes you received before parsing the body.

Pattern: ^[0-9a-f]{64}$
isa
string
required

Unix timestamp (seconds, UTC) at which the request was signed. Part of the signed string.

exp
string
required

Unix timestamp (seconds, UTC) after which the signature should be rejected; always isa + 300. Part of the signed string.

X-Cubbo-Idempotency-Key
string

Stable key for the event: identical on every retry of the same event. Sent on shippingUpdated (carrier tracking events), inventoryMovement and the replenishment events. Not sent on orderUpdated or orderFulfilled. Store the keys you have processed and ignore repeats.

Authorization
string

Bearer <token>, sent only when OAuth 2.0 client-credentials authentication has been configured for your integration by Cubbo. Cubbo requests the token from your token URL with grant_type=client_credentials and caches it until shortly before it expires.

Body

application/json

Payload of the inventoryMovement event.

event
enum<string>
required

Event name.

Available options:
inventoryMovement
Example:

"inventoryMovement"

occurred_at
string<date-time>
required

When the stock snapshot was taken.

Example:

"2026-10-12T16:25:00-06:00"

sequence
integer
required

Monotonic counter per integration. Higher means newer; gaps are possible.

Example:

42

store_id
integer
required

Cubbo store id.

Example:

1234

products
object[]
required

Current stock of each affected product.

Response

2XX

Acknowledge receipt with any 2xx status. The response body is ignored. A 429 or any 5xx response is retried; any other 4xx response is treated as a permanent rejection and is not retried. While a delivery is pending, later inventory events for the same integration wait behind it.