Webhook Settings

​

Supported Webhooks

​

Configure a Webhook

1. In the main menu, click your merchant name > Merchant Settings. The Merchant Settings page is displayed.
2. Click Webhooks (Advanced). The Webhooks page is displayed.
3. Click Add Webhook. The Add Webhook window is displayed.
4. In the Topic field, select the webhook you would like to use. Use the table provided in this document to learn about each webhook and what they do.
5. In the Method field, select a method. fabric recommends using POST.
6. In the URL field, enter the target_url. By default, the Status field is set to Enabled.
7. Click Add Webhook. You can repeat this process to add multiple webhooks.

​

Webhook History

​

Webhook automatic retry timing

• 30 seconds after the first failure
• 1 minute later
• 2 minutes later
• 4 minutes later
• 8 minutes later
• 16 minutes later
• 32 minutes later
• 64 minutes later
• 2 hours later
• 2 hours later (maximum delay)

​

Enabling notifications for disabled webhooks

• Webhook Failed to Deliver
• Webhook Disabled After Failed Attempts

1. In the main menu, click your merchant name > Merchant Settings. The Merchant Settings page is displayed.
2. Click Notifications. The Notifications page is displayed.
3. In the Webhook Notifications section, enter the desired user email address or distribution list you want the notifications sent to.
4. Toggle the Disabled button to Enabled.

​

Webhook Verification Process

​

Generating a webhook secret

1. Go to Merchant Settings > Webhooks.
2. Click Generate Secret.
3. Reveal the secret and copy it for use in your integration.

​

Using the API

1. To generate a new secret, send a POST request to:

/v1/retailers/{id}/webhooks/webhook-secret/

2. (Optional) to replace an existing secret, include the following payload in your request:

{ "replace": true }

3. A new webhook secret will be generated and returned in the response:

{
    "webhook_secret": "lpXQv26yusotoO3oVr1uHiE1hEhco8vx"
}

​

Verifying a webhook

1. Retrieve the raw webhook body. Use the exact body received from the request, without modifying whitespace, formatting, or character encoding.
2. Generate the HMAC. Create an HMAC-SHA256 hash using: Create an HMAC-SHA256 hash using your webhook secret and the raw request body.
3. Compare the signatures. Compare your computed hash to the value in the fabric-dropship-signature header. If the values match, the webhook is authentic. If they do not match, the webhook may be unverified and should be rejected.

lpXQv26yusotAO3oVr1yHiE1hEhco8vx

{"id": 1234, "purchase_order_number": "ABC-001", "status": "closed"}

fabric-dropship-signature: 5d1cae4e1081325679f6e50a52ea28193e3d6871536981f0de2ed34bfc788c2d

import hashlib
import hmac
import os

def hmac_is_valid(body, secret, signature):
    _hash = hmac.new(secret.encode('utf-8'), body.encode('utf-8'), hashlib.sha256)
    hmac_calculated = _hash.hexdigest()
    return hmac.compare_digest(hmac_calculated.encode('utf-8'), signature.encode('utf-8'))

signature = '5d1cae4e1081325679f6e50a52ea28193e3d68715b36981f0de2ed34fc788c2d'
raw_body = '{"id": 1234, "purchase_order_number": "ABC-001", "status": "closed"}'
webhook_secret = os.environ.get('DROPSHIP_WEBHOOK_SECRET') # read secret from env vars
is_authentic = hmac_is_valid(raw_body, webhook_secret, signature)
print(f'Webhook is authentic? {is_authentic}') # True