The request that arrives

This section is for your developer.

Each delivery is a POST with a JSON body. CartWhizz waits up to 30 seconds for a reply.

Headers

Older header names (deprecated). Every delivery also carries the same values as X-Trooply-Signature / X-Trooply-Event and X-eCart-Signature / X-eCart-Event, so receivers set up before the rename keep working. New receivers should read X-CartWhizz-*; the older names will be removed in a future release, announced in advance.

Body

{
  "event": "order.created",
  "payload": { "...": "the event's details" },
  "timestamp": "2026-10-17T09:30:00Z",
  "webhook_id": "3f9c1a52-0b8e-4f2a-9d31-7c0e5b1a44de"
}

• payload holds the event's details. Its fields differ per event and may gain new fields, so read only what you need.
• timestamp is when this attempt was sent, not when the event happened.
• A manual retry from the admin adds "retry": true.
• A Send Test delivery has "event": "test".

Your reply

Reply with any 2xx status quickly (for example {"ok":true}). The first 4,096 characters of your reply are shown in the delivery log, so don't include anything sensitive.