Webhooks via Flows

Webhooks let a Flow notify your own service when something happens in Cevoid, such as an order being fulfilled or a review being submitted. Your service receives a signed POST with the order, profile or review the event concerns, so you can act on it without polling the API.

Every request is signed, so you can verify it came from Cevoid. Requests are fixed POST calls with a JSON body; custom methods, custom authorization headers and inbound webhooks are not supported.

Cevoid has no per-endpoint event subscriptions. A Flow decides what reaches your endpoint:

• Destination: your HTTPS endpoint, with a signing secret Cevoid shows once. Several Flows can send to one destination.
• Trigger: the event that starts the Flow, such as Order fulfilled. Its name is the type your endpoint receives, order.fulfilled.
• Action: a step that sends the event to the destination. Forward event creates a Flow with this step for you.

Each Flow run sends one request per webhook action. origin.flow in the body names the Flow, so you can tell Flows apart when they share a destination.

Common uses, each with the event to start from:

• Send fulfilled orders to an ERP, a warehouse or a marketing tool: order.fulfilled.
• Start a follow-up once the parcel has arrived: order.delivered.
• Copy new product reviews into a CRM or a support tool: product-review.submitted.
• Route company reviews to the team that owns service quality: company-review.submitted.

The Event types page lists every event, the body they share and how payloads change over time.

1. Step 1

   Build a receiver

   Add an HTTPS route that accepts POST requests, keeps the raw request body and returns a 2xx status within 10 seconds. See Set up a webhook.

2. Step 2

   Create a Flow and a destination

   In Settings → Flows, choose Create flow → Forward event → Webhook, pick a trigger and create a destination for your URL. Copy the signing secret: it is shown once.

3. Step 3

   Verify every request

   Check the signature against the raw body before you parse it. See Verify webhook signatures.

4. Step 4

   Publish and test

   Publish the Flow and choose Trigger test run to receive a real signed event. See Test a webhook.

Every delivery is an HTTPS POST with these headers:

• Timeout: Cevoid waits 10 seconds for your response, body included. A slower response counts as a timeout and is retried.
• Body: at most 256 KiB (262,144 bytes) of JSON, with object keys sorted. A body that would be larger is never sent.
• Redirects: not followed. A 3xx response stops the delivery.
• Envelope: every event has the same top-level fields: type, id, created_at, version, origin and data. See Event types.

• At least once. Cevoid retries until your endpoint returns a 2xx status, so a response lost on the way back leads to a second request with the same webhook-id. Store the IDs you have processed and skip repeats.
• No ordering guarantee. Deliveries are sent and retried independently. Order your own state by created_at or by the timestamps of the resource in data, not by arrival.
• A snapshot of the first attempt. Cevoid reads the order, profile or review when it makes the first attempt and sends that same body on every retry. Fetch the resource from the API when you need its state right now.
• Retries for about 20 hours. A failed delivery is retried up to six times. See Retries and replays.

• Set up a webhook: create a destination and a Flow that sends events to it.
• Verify webhook signatures: check that each request came from Cevoid before you parse it.
• Retries and replays: respond, deduplicate and recover failed deliveries.
• Test a webhook: send a signed test event and read the delivery log.
• Event types: the envelope and every event.