Etsy order webhook (public, one url for the whole platform)
POST/api/hooks/etsy
Etsy's webhooks are subscribed ONCE for our Etsy app, by hand in its
developer portal (doc 78 §3.3): order.paid, order.canceled,
order.shipped, order.delivered. The body is flat
{event_type, resource_url, shop_id} (an older nested data shape is
tolerated). Signed the Standard Webhooks way — webhook-id,
webhook-timestamp, webhook-signature (v1,<base64>, several
allowed) over id.timestamp.body, HMAC-SHA256 with the whsec_
secret. A bad or stale (over 300 s) signature is 401; everything
retrying cannot fix (unknown shop, unreadable body, ignored event,
duplicate webhook-id) is 200. The order itself is fetched from
resource_url (Etsy hosts only) in a queued job and mirrored without
street address.
Request
Responses
- 200
- 401
Accepted, or acknowledged with nothing to do.
The signature does not verify, or is too old.