Skip to main content
WEBHOOK

Authorizations

Authorization
string
header
required

Token returned by POST /auth/token, sent as Authorization: Bearer <token>.

Headers

X-Webhook-Event
enum<string>
required

Name of the event (orderUpdated, orderFulfilled, shippingUpdated, inventoryMovement, replenishmentStatus, replenishmentCreated, replenishmentScheduled). Route on this header, not on the URL: all feeds can share one endpoint. Treat a request without this header as an order event.

Available options:
orderUpdated,
orderFulfilled,
shippingUpdated,
inventoryMovement,
replenishmentStatus,
replenishmentCreated,
replenishmentScheduled
X-Cubbo-Webhook-Message-Id
string<uuid>
required

UUID of this delivery attempt. It is part of the signed string. A new value is generated on every attempt, so a retry of the same event carries a different message id.

X-Cubbo-Hmac-SHA256
string
required

Lowercase hex HMAC-SHA256 of the string <message id>.<isa>.<exp>.<raw request body> computed with your webhook secret. Verify it against the exact bytes you received before parsing the body.

Pattern: ^[0-9a-f]{64}$
isa
string
required

Unix timestamp (seconds, UTC) at which the request was signed. Part of the signed string.

exp
string
required

Unix timestamp (seconds, UTC) after which the signature should be rejected; always isa + 300. Part of the signed string.

X-Cubbo-Idempotency-Key
string

Stable key for the event: identical on every retry of the same event. Sent on shippingUpdated (carrier tracking events), inventoryMovement and the replenishment events. Not sent on orderUpdated or orderFulfilled. Store the keys you have processed and ignore repeats.

Authorization
string

Bearer <token>, sent only when OAuth 2.0 client-credentials authentication has been configured for your integration by Cubbo. Cubbo requests the token from your token URL with grant_type=client_credentials and caches it until shortly before it expires.

Body

application/json

Payload of the replenishmentScheduled event.

event
enum<string>
required

Event name.

Available options:
replenishmentScheduled
Example:

"replenishmentStatus"

occurred_at
string<date-time>
required

When the payload was built.

Example:

"2026-10-21T17:45:00-06:00"

store_id
integer
required

Cubbo store id.

Example:

1234

replenishment_id
integer
required

Cubbo replenishment id.

Example:

55010

status
enum<string>
required

Status of the replenishment at the moment of the event.

Available options:
WITHOUT_SCHEDULING,
PENDING,
REQUESTED,
PROCESSING,
IN_TRANSIT,
RECEIVED,
IN_PUTAWAY,
CANCELED,
COMPLETED
Example:

"COMPLETED"

sell_ahead
boolean
required

Whether this is a presale replenishment whose stock can be sold before arrival.

Example:

false

sequence
integer<int64>
required

Ordering hint; epoch milliseconds of the transition that produced the event.

Example:

1792000000000

appointment_date
string<date> | null

Date of the booked delivery appointment, or null when none is booked.

Example:

"2026-10-20"

products
object[]

Expected vs received quantity per product. Omitted when status is CANCELED.

supplier_invoices
object[]

Supplier invoice numbers captured for the receipt. Omitted when status is CANCELED.

Response

2XX

Acknowledge receipt with any 2xx status. The response body is ignored. A 429 or any 5xx response is retried; any other 4xx response is treated as a permanent rejection and is not retried.