Skip to main content
WEBHOOK

Authorizations

Authorization
string
header
required

Token returned by POST /auth/token, sent as Authorization: Bearer <token>.

Headers

X-Webhook-Event
enum<string>
required

Name of the event (orderUpdated, orderFulfilled, shippingUpdated, inventoryMovement, replenishmentStatus, replenishmentCreated, replenishmentScheduled). Route on this header, not on the URL: all feeds can share one endpoint. Treat a request without this header as an order event.

Available options:
orderUpdated,
orderFulfilled,
shippingUpdated,
inventoryMovement,
replenishmentStatus,
replenishmentCreated,
replenishmentScheduled
X-Cubbo-Webhook-Message-Id
string<uuid>
required

UUID of this delivery attempt. It is part of the signed string. A new value is generated on every attempt, so a retry of the same event carries a different message id.

X-Cubbo-Hmac-SHA256
string
required

Lowercase hex HMAC-SHA256 of the string <message id>.<isa>.<exp>.<raw request body> computed with your webhook secret. Verify it against the exact bytes you received before parsing the body.

Pattern: ^[0-9a-f]{64}$
isa
string
required

Unix timestamp (seconds, UTC) at which the request was signed. Part of the signed string.

exp
string
required

Unix timestamp (seconds, UTC) after which the signature should be rejected; always isa + 300. Part of the signed string.

Authorization
string

Bearer <token>, sent only when OAuth 2.0 client-credentials authentication has been configured for your integration by Cubbo. Cubbo requests the token from your token URL with grant_type=client_credentials and caches it until shortly before it expires.

Body

application/json

Payload of the orderUpdated event.

id
integer
required

Cubbo order id.

Example:

987654

status
enum<string>
required

New fulfillment status of the order.

Available options:
initial,
unpaid,
empty,
pending,
error,
cancelation_window,
entirely_dropshipping,
backorder,
processing,
picking,
packing,
shipped,
canceled,
holded,
interrupted,
returned,
return_arrived,
returning,
reentered,
awaiting_fulfillment_request,
awaiting_dropoff,
arrived_at_warehouse
Example:

"picking"

order_number
string
required

Your order number, as sent when the order was created.

Example:

"ORD-0001"

updated_at
string<date-time>
required

UTC time at which the status change was recorded.

Example:

"2026-10-12T15:04:05Z"

store_id
integer
required

Cubbo store id the order belongs to.

Example:

1234

products
object[]

Order lines with the picked unit codes. Present only while status is picking or packing.

picking_status
enum<string>

Present only when the picking of the order was sent to review.

Available options:
in_review
Example:

"in_review"

created_by_return
object

Present when the order was created by a return or exchange flow.

c2c
object

Consumer-to-consumer (C2C) shipment details. Present only for C2C orders.

parent_order_id
integer

Present when this order is the child of a presale split; id of the original order.

Example:

987000

channel_name
string

Sales channel name given when the order was created, or the integration type (openapi) when none was given.

Example:

"openapi"

channel_order_id
string

Your channel order id, when it was provided at creation.

Example:

"SHOP-77421"

channel_integration_id
integer

Cubbo integration id. Present only when channel details are enabled for your store.

Example:

4321

subchannel_name
string | null

Sub-channel or marketplace name. Present only when channel details are enabled for your store.

Example:

"Marketplace A"

latest_estimated_time_arrival_range
object

Latest estimated delivery window, in UTC. Sent only when enabled for your integration; null when no estimate exists.

Response

2XX

Acknowledge receipt with any 2xx status. The response body is ignored. Respond as soon as the event is persisted and process it asynchronously. A 429 or any 5xx response is retried; any other 4xx response is treated as a permanent rejection and is not retried.