Webhook subscribers

Insight, then Webhook subscribers. A subscriber is a URL of yours that receives an HTTP POST when something happens in your shop.

Creating one

Field	Meaning
Name	What it is, for your reference
URL	Where to POST, https://example.com/webhook
Customer	Scope to one customer, or leave blank for all events
Events	Which events to receive
Active	Off stops deliveries without deleting the subscriber

Events

Event	Fires when
order.stage_changed	An order moves stage
order.dispatched	An order reaches Dispatched
invoice.issued	An invoice is issued
invoice.paid	An invoice is paid
artwork.approved	A customer approves artwork
*	All of the above

Verifying a delivery

Each POST carries:

Header	Value
X-PF-Event	The event name
X-PF-Signature	sha256= plus an HMAC-SHA256 of the raw body, keyed with your subscriber's secret

Compute the HMAC over the raw request body and compare in constant time. Reject anything that does not match: an unverified webhook endpoint is an open door.

Retries

Failed deliveries retry 5 times with backoff of 1 minute, 5 minutes, 15 minutes, 1 hour and 4 hours. Design your endpoint to be idempotent: the same event can arrive more than once, and treating a duplicate as new is how you end up with double records.

Return a 2xx quickly. Do the work asynchronously on your side rather than holding the connection open; deliveries time out after 10 seconds.

Plan gate

Webhooks need Premium or above. On a lower plan your subscribers stay saved and deliveries stop, with the reason logged rather than silently dropped. Nothing is deleted, and moving back up resumes them.

Full reference

Payload shapes and a worked verification example are in webhook events.