Inbound webhook endpoint

/hooks/{org_slug}/{source} — POST

POST/hooks/{org_slug}/{source}

When your site says “an order changed”, the order record is refreshed immediately. source: woocommerce (WooCommerce’s own webhook, X-WC-Webhook-Signature) or generic (your own system, X-Zitena-Signature). The same delivery id is not processed twice within 24 hours. 404 if the company or its secret is not configured. Details: the inbound webhook guide.

Authentication: HMAC signature header (no API key).

Parameters

Name	In	Type	Limits	Meaning
org_slug *	path	string		Your company slug (shown in the address on the Inbound webhook page).
source *	path	string		woocommerce or generic.

Example

SECRET=whsec_xxx
BODY='{"id": "evt-0001", "event": "order.updated", "order": {"external_id": "98765", "status": "shipped", "created_at": "2026-09-24T10:15:00+03:00", "modified_at": "2026-09-24T15:00:00+03:00", "tracking_number": "123456789012"}}'
TS=$(date +%s)
SIG=$(printf '%s.%s' "$TS" "$BODY" | openssl dgst -sha256 -hmac "$SECRET" -hex | sed 's/^.* //')
curl -s -X POST "$RZ_API/hooks/firma/generic" -H "Content-Type: application/json" \
  -H "X-Zitena-Signature: t=$TS,v1=$SIG" -d "$BODY"

Response 200

{
  "ok": true,
  "orders": 1,
  "inserted": 0,
  "updated": 1,
  "unchanged": 0
}

Error statuses: 401, 404, 413, 422 — see Errors and limits.

Guide: Inbound webhook