Webhooks

A webhook is an HTTP POST that a marketplace sends to a URL you own as soon as something happens: a user signs up, a listing is edited, an order is accepted by the vendor. Use webhooks to keep an ERP, a CRM, a warehouse or a data pipeline in sync without polling the Admin API.

Event types18 events on users, listings and orders, and when each one fires.

Payload formatThe envelope, the object in its latest state, deletions.

Verifying signaturesCheck the HMAC-SHA256 signature, reject replays. Node.js, PHP, Python.

Delivery, retries and logsResponse rules, retry schedule, deduplication, logs and resend.

Create a webhook

1. In the back office of the marketplace, open Settings → Notifications (/admin/settings/notifications) and scroll to Webhooks.

2. Click Create a webhook, pick the Event and enter the URL of your endpoint. Use a public HTTPS URL.

3. Save. The webhook is created signed. Copy its signing secret into your endpoint’s configuration: you need it to verify signatures.

4. Click Send test notification. Your endpoint receives a sample payload for that event, signed exactly like a real delivery.

One webhook listens to one event type. To receive several events, create one webhook per event. They can all point to the same URL: every payload says which event it carries in its type field.

One webhook per event type

Create a single webhook per event type on a marketplace. When two webhooks listen to the same event, only one of them receives the deliveries. If several systems need the same event, receive it once and forward it on your side.

What a request looks like

POST /kreezalid/webhooks HTTP/1.1
Host: erp.example.com
User-Agent: kreezalid-webhook
Content-Type: application/json
X-Kreezalid-Event-Id: 918273
X-Kreezalid-Timestamp: 1760385600
X-Kreezalid-Signature: sha256=76b07d4f3198f2dbf1928bd162dc3dff72a429708bb4de940957702b4b6eab91

{"type":"order.status.accepted","created":"2026-10-13 20:00:00","status":"success","data":{"object":"Order","id":4242,"number":"R-4242","status":"accepted","amount":"120.00","currency":"EUR"}}

The data object is shortened here. In a real delivery it holds the complete order, as the Admin API returns it.

Your endpoint, in three steps

1. Verify the signature against the raw request body. Reject the request with 401 if it does not match or if the timestamp is too old.

2. Answer 2xx quickly, within a few seconds. Kreezalid waits up to 30 seconds, then counts the attempt as failed and retries later.

3. Process the event in the background, and make that processing idempotent with the X-Kreezalid-Event-Id header: the same event can be delivered more than once.

Webhooks and the API work together

A webhook tells you that something changed and gives you the object as it is now. The Admin API remains the way to read anything else, to catch up after your endpoint was down for a while, or to write back to the marketplace. A robust integration uses both: webhooks for real time, and a periodic API sync as a safety net. The guide Sync orders to an ERP puts the two together.