Webhooks (Advanced)

​

Supported Webhook Events

​

Orders

​

Connections

​

Proposals

​

Returns (RMAs)

​

Adding a webhook

1. Click your business name in the menu at the top of the page in Dropship and click Supplier Settings. The Supplier Settings page is displayed.
2. Click Webhooks (Advanced). The Webhooks page is displayed.
3. On the Webhooks page, click Add Webhook. The Add Webhook window is displayed.
4. In the Topic field, select the event you want to subscribe to.
5. In the Method field, select the HTTP method to use, whether POST, PUT, or PATCH. This determines how the event payload is sent to your server.
6. In the URL field, enter the publicly accessible endpoint where you want to receive the webhook.
7. In the Status field, select whether the webhook should be Enabled or Disabled.
8. Click Add Webhook to save the configuration.

​

Viewing webhook history

​

Webhook automatic retry timing

• 30 seconds after the first failure
• 1 minute later
• 2 minutes later
• 4 minutes later
• 8 minutes later
• 16 minutes later
• 32 minutes later
• 64 minutes later
• 2 hours later
• 2 hours later (maximum delay)

• Prevent notification overload by stopping repeated delivery attempts to an endpoint that is consistently unavailable, which could otherwise strain internal queues and downstream systems.
• Maintain system stability by avoiding endless retry loops to non-functional endpoints.
• Address potential security concerns, as persistent failures may indicate misconfiguration or malicious behavior.
• Improve visibility and user experience by clearly signaling that action is required, rather than allowing silent, ongoing failures.

​

Webhook Verification Process

​

Generating a webhook secret

1. Go to Supplier Settings > Webhooks.
2. Click Generate Secret.
3. Reveal the secret and copy it for use in your integration.

​

Using the API

1. To generate a new secret, send a POST request to:

/v1/brands/{id}/webhooks/webhook-secret/

2. (Optional) to replace an existing secret, include the following payload in your request:

{ "replace": true }

3. A new webhook secret will be generated and returned in the response:

{
    "webhook_secret": "lpXQv26yusotoO3oVr1uHiE1hEhco8vx"
}

​

Verifying a webhook

1. Retrieve the raw webhook body. Use the exact body received from the request, without modifying whitespace, formatting, or character encoding.
2. Generate the HMAC. Create an HMAC-SHA256 hash using: Create an HMAC-SHA256 hash using your webhook secret and the raw request body.
3. Compare the signatures. Compare your computed hash to the value in the fabric-dropship-signature header. If the values match, the webhook is authentic. If they do not match, the webhook may be unverified and should be rejected.

lpXQv26yusotAO3oVr1yHiE1hEhco8vx

{"id": 1234, "purchase_order_number": "ABC-001", "status": "closed"}

fabric-dropship-signature: 5d1cae4e1081325679f6e50a52ea28193e3d6871536981f0de2ed34bfc788c2d

import hashlib
import hmac
import os

def hmac_is_valid(body, secret, signature):
    _hash = hmac.new(secret.encode('utf-8'), body.encode('utf-8'), hashlib.sha256)
    hmac_calculated = _hash.hexdigest()
    return hmac.compare_digest(hmac_calculated.encode('utf-8'), signature.encode('utf-8'))

signature = '5d1cae4e1081325679f6e50a52ea28193e3d68715b36981f0de2ed34fc788c2d'
raw_body = '{"id": 1234, "purchase_order_number": "ABC-001", "status": "closed"}'
webhook_secret = os.environ.get('DROPSHIP_WEBHOOK_SECRET') # read secret from env vars
is_authentic = hmac_is_valid(raw_body, webhook_secret, signature)
print(f'Webhook is authentic? {is_authentic}') # True

​

Notifications for disabled webhooks

• Webhook failed to deliver
• Webhook disabled after failed attempts

1. Click your business name in the menu at the top of the page in Dropship and click Supplier Settings. The Supplier Settings page is displayed.
2. Click Notifications. The Notifications page is displayed.
3. In the Webhook Notifications section, enter an email address or distribution list in one or both of the Webhook Failed to Deliver or Webhook Disabled After Failed Attempts fields. To enter multiple addresses, separate them by commas.
4. Click the toggle button next to the notifications you want to enable.