Dispatching Webhook notifications

What is a Webhook?

A webhook is a technology that enables real-time communication between systems. It works by sending automated messages or data to a specified URL when certain events occur. Unlike traditional APIs, which require constant polling for updates, webhooks push information immediately as the event happens, making them efficient for triggering actions or updating systems in real time.


Webhook Implementation in WISMOlabs

Within the WISMOlabs platform, every process, such as order shipment or return, is driven by a series of events. For example, an outbound shipment may progress through stages like packaging, pickup by the carrier, shipping, out for delivery, and final delivery. Other events might include customs clearances for international deliveries, delays, failed delivery attempts, or a return to sender. Similarly, a return process could involve return request initiation, return request approval, shipment back to the return processing center, verification, and refund issuance. Each of these steps is an event that can trigger a webhook notification.


Webhook notifications are vital for keeping your entire technological stack in sync, ensuring all systems are updated with the latest status changes. WISMOlabs offers fully configurable webhook payloads that can be customized using the Liquid templating language. All webhook payloads must be valid JSON format. Please ensure compatibility with your systems.

  • Outbound shipment (orders) webhooks are managed via Settings > Alerts > Webhooks.
  • Inbound shipments (returns) webhooks are managed via Settings > Returns > Webhooks.

This flexibility allows retailers to ensure all aspects of their order and return processes are aligned and responsive to customer needs in real time.


Verifying Webhooks with Signature

Because webhooks operate via simple HTTP POST requests from unknown sources, malicious actors can exploit this mechanism to send unauthorized data. This vulnerability can lead to data breaches, unauthorized actions, or other security incidents within your application.

In order to prevent it, WISMOlabs signs every webhook and its metadata with a unique key for each endpoint. This signature can then be used to verify the webhook indeed comes from WISMOlabs, and only process it if it is.

A webhook signature is a webhook security mechanism used to verify the authenticity and integrity of webhook messages sent from a provider to a receiver. It is generated by the provider using a shared secret key and an encryption algorithm. WISMOlabs uses HMAC-SHA256 algorithm to generate Hash-based Message Authentication Code) passed in the Header svix-signature with Base64 encoding.

You can lookup and update your unique signature associated with your end-point for your shipment notifications webhooks under Settings > Webhooks > Logbook. Then click on the end-point to view Signing Secret.

Ensuring JSON Consistency in Liquid Templates

Note: It is extremely important to ensure that the rendered Liquid template results in valid JSON format. When using Liquid variables that may have no or null values, use the default filter to maintain JSON consistency. This ensures the value is wrapped in brackets and the JSON remains valid. For example, when handling optional values, use:

"parameter": {{payload.optional.OPTIONAL_VALUE | default: ''}}


Webhook Deliverability and Retry Schedule

If your configured endpoint fails to retrieve a webhook payload due to unavailability and does not respond with a 200 OK message, WISMOlabs will retry using an exponential backoff schedule:

  • Immediately
  • 5 seconds
  • 5 minutes
  • 30 minutes
  • 2 hours
  • 5 hours
  • 10 hours
  • 10 hours (in addition to the previous)

This gives you time to fix a potentially broken endpoint without bottlenecking the system with failing messages.




Related Articles