Webhook events

The events your shop’s webhooks get, their signature, the body and the retries.

Updated 3 November 2026Live from Tocler

Event	When
order.created	A new order (shop or API), waiting for its payment.
order.paid	The payment was confirmed; what can be delivered at once was delivered.
order.fulfilled	Every line of a paid order is delivered (services, API delivery, parcels).
order.refunded	The shop refunded all or part of an order.
stock.low	A product reached the shop’s “running low” number (Inventory → Alert rules).

Header	Value
x-tocler-event	The event type (or ping from the Test button)
x-tocler-timestamp	Unix seconds
x-tocler-signature	v1=<hex HMAC-SHA256 of "<timestamp>.<raw body>" with the webhook’s signing secret>
x-tocler-delivery	The event id — the same on every retry: handle each id once

An event

{
  "id": "evt_5b1f0c2a9e7d4a11b2c3d4e5",
  "object": "event",
  "type": "order.paid",
  "api_version": "2026-11-03",
  "created": 1793700000,
  "store": {
    "id": "665f1c2e9b1e8a0012345678"
  },
  "data": {
    "order": {
      "id": "TRX8F2K1",
      "object": "order",
      "status": "paid",
      "via": "api",
      "currency": "EUR",
      "totals": {
        "total": {
          "amount": "19.98",
          "currency": "EUR"
        }
      },
      "lines": [
        {
          "index": 0,
          "name": "Game top-up",
          "quantity": 2
        }
      ]
    }
  }
}

Answer 2xx within 10 seconds. Anything else is tried again after 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours and 24 hours; 15 failures in a row switch the webhook off (the owner switches it on again in Dashboard → Developers → Webhooks, and can send any event again). Check every signature — the code is in Webhooks and signatures.

Was this page helpful?