Webhooks

Subscribe to cross-system events. We POST JSON to your endpoint the moment things happen — no polling needed.

Events

shipment.deliveredWMS shipment confirmed delivered

sales_order.releasedOMS order released to WMS

inbound_receipt.completedWMS inbound receipt completed

drayage_order.completedDrayage order completed (container delivered)

inventory.adjustedInventory adjusted

wave.releasedPick wave released

transport_order.podTMS proof of delivery uploaded

trial.expiringTrial expires in 30 days

Webhook payload

{
  "event": "shipment.delivered",
  "at": "2026-10-06T18:42:11Z",
  "data": { "shipment_id": "shp_2041",
    "merchant_id": "mch_acme",
    "delivered_at": "2026-10-06T18:40:02Z" }
}

Verify signatures

Each delivery carries X-Bodegito-Signature (HMAC-SHA256 of the raw body with your webhook secret) and X-Bodegito-Timestamp. Reject anything older than 5 minutes or with a bad signature.

Headers + verify

X-Bodegito-Signature: sha256=9f2c...a1
X-Bodegito-Timestamp: 1728268931

# verify (node)
crypto.timingSafeEqual(
  Buffer.from(received),
  Buffer.from('sha256=' + crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(rawBody).digest('hex'))
);

Retries

We expect a 2xx within 10 seconds. Otherwise we retry with exponential backoff (1m → 5m → 30m → 2h → 12h), then park the event in the dead-letter queue for 7 days.