The request that arrives

This section is for your developer.

Each delivery is a POST with a JSON body. CartWhizz waits up to 30 seconds for a reply.

Headers

Header	Value
`Content-Type`	`application/json`
`X-Trooply-Signature`	`sha256=<hex>` — the signature to verify
`X-eCart-Signature`	The same signature (sent for compatibility)
`X-Trooply-Event` / `X-eCart-Event`	The event name

The header names keep the platform's older internal names; they are what your receiver should look for.

Body

{
  "event": "order.created",
  "payload": { "...": "the event's details" },
  "timestamp": "2026-10-17T09:30:00Z",
  "webhook_id": "3f9c1a52-0b8e-4f2a-9d31-7c0e5b1a44de"
}

payload holds the event's details. Its fields differ per event and may gain new fields, so read only what you need.
timestamp is when this attempt was sent, not when the event happened.
A manual retry from the admin adds "retry": true.
A Send Test delivery has "event": "test".

Your reply

Reply with any 2xx status quickly (for example {"ok":true}). The first 4,096 characters of your reply are shown in the delivery log, so don't include anything sensitive.

PreviousEvent types NextVerifying the signature