Webhooks
Signed, retried, observable. Webhooks are how your backend learns an agent completed a checkout — and how you prove the integration is production-ready.
Register an endpoint
curl -X POST https://api.ordercore.ai/v1/webhooks/endpoints \
-H "X-API-Key: oc_live_..." -H "Content-Type: application/json" \
-d '{"url": "https://your-app.example/webhooks/ordercore", "events": ["checkout.completed"]}'The response returns a signing secret once — store it securely; it is never shown again. Primary event today: checkout.completed (event names are normalized to lowercase).
Verify signatures
Every delivery is signed with your endpoint secret. Verify the signature before trusting the payload — an unsigned or mis-signed request is not from OrderCore.
Retries and idempotent consumption
Failed deliveries are retried automatically on retryable failures with backoff. Because deliveries can arrive more than once, consume idempotently: use the order id as your dedupe key, exactly as agent-side retries use idempotency keys.
Observability: deliveries and metrics
Pending, failed, abandoned, and successful deliveries are exposed via the deliveries and metrics endpoints, so support (and your dashboards) can see webhook health per tenant. GET /v1/account/readiness includes webhook checks — an active checkout.completed endpoint, a recent successful delivery, and no abandoned deliveries in the last 24h — as part of the go-live checklist.