{
  "id": 987654,
  "order_number": "ORD-0001",
  "carrier_name": "Estafeta",
  "first_name": "Ana",
  "last_name": "Example",
  "city": "Ciudad de México",
  "country": "MX",
  "status": "shipped",
  "store_id": 1234,
  "tracking_urls": [
    "https://tracking.example.com/orders/abc123"
  ],
  "tracking_number": "1234567890123456789012",
  "updated_at": "2026-10-12T16:20:00Z",
  "zip_code": "06600",
  "estimated_time_arrival": "2026-10-14T23:59:59Z",
  "channel_name": "openapi",
  "channel_order_id": "SHOP-77421"
}

Webhooks

Order shipped fulfilled

Cubbo sends this event to your order webhook URL when the order’s shipping labels are generated and the order leaves packing, i.e. when it becomes shipped. It carries the recipient’s name and destination, the carrier, the tracking number of the first package and the Cubbo tracking page URL. An orderUpdated event with status: shipped is sent separately for the same transition.

tracking_number is the first package’s carrier tracking number; tracking_urls contains the Cubbo tracking page link, not the carrier’s.
zip_code is "-" for orders shipped from Chile when no postal code was given; city and zip_code can be null for orders the client collects at the warehouse.
extended_zone is added when the “include extended zone in webhooks” setting is enabled for your store by Cubbo.
order_lines is added when the “include order line details in webhooks” setting is enabled for your store by Cubbo.
channel_integration_id, channel_order_id and subchannel_name are added when the “include channel details in webhooks” setting is enabled for your store by Cubbo.
shipping_type, delivery_type, billing_category and latest_estimated_time_arrival_range are added only when those extra fields are enabled for your integration by Cubbo.
Retries resend the same body. There is no X-Cubbo-Idempotency-Key header on this event; use (id, status, updated_at) or (order_number, tracking_number) to deduplicate.

WEBHOOK

orderFulfilled

{
  "id": 987654,
  "order_number": "ORD-0001",
  "carrier_name": "Estafeta",
  "first_name": "Ana",
  "last_name": "Example",
  "city": "Ciudad de México",
  "country": "MX",
  "status": "shipped",
  "store_id": 1234,
  "tracking_urls": [
    "https://tracking.example.com/orders/abc123"
  ],
  "tracking_number": "1234567890123456789012",
  "updated_at": "2026-10-12T16:20:00Z",
  "zip_code": "06600",
  "estimated_time_arrival": "2026-10-14T23:59:59Z",
  "channel_name": "openapi",
  "channel_order_id": "SHOP-77421"
}

Authorizations

Authorization

string

header

required

Token returned by POST /auth/token, sent as Authorization: Bearer <token>.

Headers

X-Webhook-Event

enum<string>

required

Name of the event (orderUpdated, orderFulfilled, shippingUpdated, inventoryMovement, replenishmentStatus, replenishmentCreated, replenishmentScheduled). Route on this header, not on the URL: all feeds can share one endpoint. Treat a request without this header as an order event.

Available options:

orderUpdated,

orderFulfilled,

shippingUpdated,

inventoryMovement,

replenishmentStatus,

replenishmentCreated,

replenishmentScheduled

X-Cubbo-Webhook-Message-Id

string<uuid>

required

UUID of this delivery attempt. It is part of the signed string. A new value is generated on every attempt, so a retry of the same event carries a different message id.

X-Cubbo-Hmac-SHA256

string

required

Lowercase hex HMAC-SHA256 of the string <message id>.<isa>.<exp>.<raw request body> computed with your webhook secret. Verify it against the exact bytes you received before parsing the body.

Pattern: ^[0-9a-f]{64}$

isa

string

required

Unix timestamp (seconds, UTC) at which the request was signed. Part of the signed string.

exp

string

required

Unix timestamp (seconds, UTC) after which the signature should be rejected; always isa + 300. Part of the signed string.

Authorization

string

Bearer <token>, sent only when OAuth 2.0 client-credentials authentication has been configured for your integration by Cubbo. Cubbo requests the token from your token URL with grant_type=client_credentials and caches it until shortly before it expires.

Body

application/json

Payload of the orderFulfilled event.

integer

required

Cubbo order id.

Example:

987654

order_number

string

required

Your order number.

Example:

"ORD-0001"

carrier_name

string | null

required

Carrier that will deliver the order.

Example:

"Estafeta"

status

string

required

Fulfillment status at the moment of shipping; normally shipped.

Example:

"shipped"

store_id

integer

required

Cubbo store id.

Example:

1234

tracking_urls

string<uri>[]

required

Cubbo tracking page URL for the order (one element).

Example:

[
  "https://tracking.example.com/orders/abc123"
]

tracking_number

string | null

required

Carrier tracking number of the first package.

Example:

"1234567890123456789012"

updated_at

string<date-time>

required

When the order was last updated (time of shipping).

Example:

"2026-10-12T16:20:00Z"

first_name

string | null

Recipient first name.

Example:

"Ana"

last_name

string | null

Recipient last name.

Example:

"Example"

city

string | null

Destination city. null for orders collected at the warehouse.

Example:

"Ciudad de México"

country

string | null

Destination country code.

Example:

"MX"

zip_code

string | null

Destination postal code. "-" for Chile shipments without a postal code; null for warehouse pickups.

Example:

"06600"

estimated_time_arrival

string<date-time> | null

Estimated delivery date and time, when known.

Example:

"2026-10-14T23:59:59Z"

extended_zone

boolean

Whether the destination postal code is an extended delivery zone for the carrier. Present only when enabled for your store.

Example:

false

channel_name

string

Sales channel name given at creation, or the integration type when none was given.

Example:

"openapi"

channel_order_id

string

Your channel order id, when it was provided at creation.

Example:

"SHOP-77421"

channel_integration_id

integer

Cubbo integration id. Present only when channel details are enabled for your store.

Example:

4321

subchannel_name

string | null

Sub-channel or marketplace name. Present only when channel details are enabled for your store.

Example:

"Marketplace A"

order_lines

object[]

Shipped order lines with product and unit detail. Present only when enabled for your store.

Show child attributes

created_by_return

object

Present when the order was created by a return or exchange flow.

Show child attributes

shipping_type

string | null

Shipping method type. Present only when enabled for your integration.

Example:

"standard"

delivery_type

string | null

Delivery type of the shipping method. Present only when enabled for your integration.

Example:

"home_delivery"

billing_category

string | null

Billing service category of the shipping label. Present only when enabled for your integration.

Example:

"STANDARD"

latest_estimated_time_arrival_range

object

Latest estimated delivery window, in UTC. Sent only when enabled for your integration; null when no estimate exists.

Show child attributes

Response

2XX

Acknowledge receipt with any 2xx status. The response body is ignored. A 429 or any 5xx response is retried; any other 4xx response is treated as a permanent rejection and is not retried.

Authentication

Orders

Click and collect

Inventory

Lots

Shipping labels

Replenishments

Reports

Returns

Shipping methods

Stores

Webhooks

Order shipped fulfilled

Authorizations

Headers

Body

Response