Skip to content

Payload format

Every webhook carries the same envelope: the event name, when it happened, and the object it concerns. The object is the one the Admin API returns, so the code that reads a user, a listing or an order from the API also reads it from a webhook.

{
"type": "order.status.accepted",
"created": "2026-10-13 20:00:00",
"status": "success",
"data": { "object": "Order", "id": 4242, "…": "…" },
"comment": "Accepted after a phone call with the customer"
}
Field Type Description
type string The event, for instance order.status.accepted.
created string When the event happened, in UTC, formatted YYYY-MM-DD HH:MM:SS.
status string Always success for the events you can subscribe to.
data object The user, listing or order concerned. See below.
comment string Order status events only, and only when the status change came with a comment, for instance the reason an administrator gave. Absent otherwise.

data holds the full object, with an object field naming its kind (User, Listing or Order) and its id. Its fields are those of the Admin API:

data.object Same shape as
User GET /api/v1/users/{id}
Listing GET /api/v1/listings/{id}, with its user, supplier and owner
Order GET /api/v1/orders/{id}, with its customer, supplier, order_items, shippings and payout

URLs inside the object (url, profile_url, customer_url, supplier_url, the URLs of order items) are absolute and use the marketplace’s primary address, its custom domain when it has one.

These payloads are shortened to their most used fields.

{
"type": "user.creation",
"created": "2026-10-13 09:12:44",
"status": "success",
"data": {
"object": "User",
"id": 1187,
"external_id": null,
"email": "jane@example.com",
"first_name": "Jane",
"last_name": "Doe",
"public_name": "Jane D.",
"username": "jane-doe",
"account_type": "individual",
"group": { "object": "Group", "id": 3, "name": "Sellers", "alias": "seller" },
"group_id": 3,
"status": "enabled",
"lang": "en",
"locale": "en_US",
"timezone": "Europe/Paris",
"address_country": "FR",
"listing_count": 0,
"profile_url": "https://acme.mykreezalid.com/users/jane-doe",
"created_at": "2026-10-13 09:12:44",
"metafields": null
}
}

When the object no longer exists at delivery time, typically after a deletion, data only holds its kind and identifier:

{
"type": "listing.delete",
"created": "2026-10-13 16:20:31",
"status": "success",
"data": { "id": 9050, "object": "Listing" }
}

Keep the identifiers you need (your own external_id mapping for instance) on your side: you cannot read a deleted object back. user.delete is the exception: it carries the account as it was when it was deleted.

Signed webhooks, the default for every webhook created today, send the envelope as JSON (Content-Type: application/json, UTF-8). Verify the signature against these exact bytes before parsing them: see Verifying signatures.