Webhooks

Webhook handling is documented for approved private-beta event-delivery pilots. Quote, order, and workflow webhooks are not public-current production enablements for every Partner API key.

---

Availability

• webhook management requires an active registry key with webhooks:manage
• event delivery depends on contract, entitlement, and rollout state
• API key format alone does not enable webhook traffic
• RFQ/quote/order automation must also be present in the published contract before public client use

---

Delivery basics

• HTTPS only
• signed requests
• retry on timeout or non-2xx response
• idempotent consumer design recommended

---

Event families

Event family	Example events	Current posture
Quote lifecycle	quote.received, quote.updated	Private-beta / rollout controlled
Order lifecycle	order.created, order.confirmed, order.shipped	Private-beta / rollout controlled
Workflow signals	partner-specific operational events	Contract-specific

The exact event set depends on entitlement and rollout posture.

---

Example payload shape

{
  "id": "evt_01js3q7d9w4b2k8m1z0h3v6x7y",
  "event": "quote.received",
  "timestamp": "2026-04-16T10:00:00.000Z",
  "data": {
    "rfqId": "rfq_123456",
    "quoteId": "quote_987654"
  }
}

---

Signature verification

import crypto from 'node:crypto';

export function verifyWebhookSignature(rawBody: string, signature: string, secret: string) {
  const digest = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  return signature === `sha256=${digest}`;
}

Verify the raw body before JSON parsing or business logic.

---

Consumer guidance

• return 2xx quickly after verification and enqueue heavier work
• store delivery IDs to keep processing idempotent
• log request IDs and event IDs
• rotate webhook secrets on a regular cadence
• keep consumers tolerant of event families that are not enabled for your rollout

---

Related docs