Webhooks

Controlled Beta

Outbound webhooks are implemented for controlled testing but not deployed publicly. FreshlyCart operators provision endpoints; there is no public self-service endpoint-management API.

FreshlyCart sends the exact canonical event JSON with FreshlyCart-Event-Id, FreshlyCart-Delivery-Id, FreshlyCart-Timestamp, and FreshlyCart-Signature headers. Delivery is at least once; deduplicate by stable evt_ ID.

Verify v1=HMAC-SHA256(secret, timestamp + "." + exact_raw_body) using constant-time comparison. Reject timestamps outside five minutes, verify before parsing, durably record the event identity, then return 2xx quickly.

Network errors, 408, 425, 429, and 5xx receive bounded retries, at most 12 attempts in 24 hours. Retry-After is honored up to one hour. 410 disables the endpoint. Reconcile through the event feed and resource reads; webhooks alone are not synchronization correctness.