API delivery contract
The request Tocler sends your endpoint, field by field, and the answer it accepts (API version 2026-10-30).
| Header | Value |
|---|---|
| Content-Type | application/json |
| User-Agent | Tocler-API-Delivery/1 |
| x-tocler-event | order.paid · test |
| x-tocler-timestamp | Unix seconds |
| x-tocler-signature | v1=<hex HMAC-SHA256 of "<timestamp>.<raw body>" with your endpoint secret> |
| x-tocler-delivery | The delivery id (same as body id) |
| Body field | Type | Meaning |
|---|---|---|
| id | string | Delivery id: <order id>.<line index>. Stable across retries. |
| event | string | order.paid or test |
| test | boolean | Only on test requests: true |
| apiVersion | string | 2026-10-30 |
| createdAt | string | When this request was made (ISO 8601) |
| attempt | integer | 1, 2, … on retries |
| store | object | id, name, url |
| order | object | id, createdAt, currency (ISO 4217), total (decimal text), paidWith |
| line | object | index, quantity, unitPrice, product { id, name, sku }, variant { id, name, sku } |
| fields | object | The buyer’s answers by question key |
| fieldList | array | [{ id, key, label, value }] — every answer, with or without a key (value null when erased) |
| buyer | object | { email } — only if the endpoint sends the buyer’s email |
| Answer field | Type | Rule |
|---|---|---|
| items | array | Exactly line.quantity items: text (≤ 4 KB) or an object of ≤ 8 labelled values |
| message | string | ≤ 2,000 characters, shown to the buyer |
Answer 2xx with at least items or message, within 10 seconds, at most 64 KB. Anything else counts as a failure and is retried (1, 5, 15 and 30 minutes). The full walk-through: API delivery for developers.
Was this page helpful?