# Webhooks via Flows

> Receive signed Cevoid events at your HTTPS endpoint when a Flow runs, and act on orders and reviews without polling.

Breadcrumb: Webhooks › Overview · Updated: 2026-10-18
Docs index: https://docs.cevoid.com/developers/llms.txt

Webhooks let a Flow notify your own service when something happens in Cevoid, such as an order being fulfilled or a review being submitted. Your service receives a signed `POST` with the order, profile or review the event concerns, so you can act on it without polling the [API](https://docs.cevoid.com/developers/api.md).

Every request is signed, so you can verify it came from Cevoid. Requests are fixed `POST` calls with a JSON body; custom methods, custom authorization headers and inbound webhooks are not supported.

## How webhooks work

Cevoid has no per-endpoint event subscriptions. A Flow decides what reaches your endpoint:

- **Destination:** your HTTPS endpoint, with a signing secret Cevoid shows once. Several Flows can send to one destination.
- **Trigger:** the event that starts the Flow, such as _Order fulfilled_. Its name is the `type` your endpoint receives, `order.fulfilled`.
- **Action:** a step that sends the event to the destination. **Forward event** creates a Flow with this step for you.

Each Flow run sends one request per webhook action. `origin.flow` in the body names the Flow, so you can tell Flows apart when they share a destination.

## Events

Common uses, each with the event to start from:

- Send fulfilled orders to an ERP, a warehouse or a marketing tool: [`order.fulfilled`](https://docs.cevoid.com/developers/webhooks/order-fulfilled.md).
- Start a follow-up once the parcel has arrived: [`order.delivered`](https://docs.cevoid.com/developers/webhooks/order-delivered.md).
- Copy new product reviews into a CRM or a support tool: [`product-review.submitted`](https://docs.cevoid.com/developers/webhooks/product-review-submitted.md).
- Route company reviews to the team that owns service quality: [`company-review.submitted`](https://docs.cevoid.com/developers/webhooks/company-review-submitted.md).

The [Event types](https://docs.cevoid.com/developers/webhooks/event-types.md) page lists every event, the body they share and how payloads change over time.

## Quickstart

1. **Build a receiver**

   Add an HTTPS route that accepts `POST` requests, keeps the raw request body and returns a `2xx` status within 10 seconds. See [Set up a webhook](https://docs.cevoid.com/developers/webhooks/set-up.md#build-the-receiver).

2. **Create a Flow and a destination**

   In Settings → Flows, choose Create flow → Forward event → Webhook, pick a trigger and create a destination for your URL. Copy the signing secret: it is shown once.

3. **Verify every request**

   Check the signature against the raw body before you parse it. See [Verify webhook signatures](https://docs.cevoid.com/developers/webhooks/verify-signatures.md).

4. **Publish and test**

   Publish the Flow and choose Trigger test run to receive a real signed event. See [Test a webhook](https://docs.cevoid.com/developers/webhooks/testing.md).

## Request contract

Every delivery is an HTTPS `POST` with these headers:

| Header | Value |
| --- | --- |
| `content-type` | `application/json` |
| `user-agent` | `Cevoid-Webhooks/1.0` |
| `webhook-id` | The event ID, the same as `id` in the body. Retries keep it. |
| `webhook-timestamp` | Unix seconds when this attempt was signed. Every attempt gets a new one. |
| `webhook-signature` | One or more `v1,<base64>` signatures, separated by spaces. See [Verify webhook signatures](https://docs.cevoid.com/developers/webhooks/verify-signatures.md). |

- **Timeout:** Cevoid waits 10 seconds for your response, body included. A slower response counts as a timeout and is retried.
- **Body:** at most 256 KiB (262,144 bytes) of JSON, with object keys sorted. A body that would be larger is never sent.
- **Redirects:** not followed. A `3xx` response stops the delivery.
- **Envelope:** every event has the same top-level fields: `type`, `id`, `created_at`, `version`, `origin` and `data`. See [Event types](https://docs.cevoid.com/developers/webhooks/event-types.md#envelope).

## Delivery semantics

- **At least once.** Cevoid retries until your endpoint returns a `2xx` status, so a response lost on the way back leads to a second request with the same `webhook-id`. Store the IDs you have processed and skip repeats.
- **No ordering guarantee.** Deliveries are sent and retried independently. Order your own state by `created_at` or by the timestamps of the resource in `data`, not by arrival.
- **A snapshot of the first attempt.** Cevoid reads the order, profile or review when it makes the first attempt and sends that same body on every retry. Fetch the resource from the API when you need its state right now.
- **Retries for about 20 hours.** A failed delivery is retried up to six times. See [Retries and replays](https://docs.cevoid.com/developers/webhooks/retries-and-replays.md).

## Next steps

- [Set up a webhook](https://docs.cevoid.com/developers/webhooks/set-up.md): create a destination and a Flow that sends events to it.
- [Verify webhook signatures](https://docs.cevoid.com/developers/webhooks/verify-signatures.md): check that each request came from Cevoid before you parse it.
- [Retries and replays](https://docs.cevoid.com/developers/webhooks/retries-and-replays.md): respond, deduplicate and recover failed deliveries.
- [Test a webhook](https://docs.cevoid.com/developers/webhooks/testing.md): send a signed test event and read the delivery log.
- [Event types](https://docs.cevoid.com/developers/webhooks/event-types.md): the envelope and every event.

**Recent changes**

- [Review replies can trigger webhooks](https://docs.cevoid.com/developers/changelog.md#2026-09-09-review-reply-webhook-events) (Added, 2026-09-09): Flows can start when you reply to a review, with the new product-review\.replied and company-review\.replied events, and deliver them to a webhook destination through the Send notification action.
- [UGC and loyalty events can trigger webhooks](https://docs.cevoid.com/developers/changelog.md#2026-09-08-ugc-and-loyalty-webhook-events) (Added, 2026-09-08): Flows can start from five new events and deliver them to a webhook destination through the Send notification action, so your endpoint hears about uploads, tiers, rewards and expiring points.
- [A smaller webhook envelope and separate review events](https://docs.cevoid.com/developers/changelog.md#2026-08-11-webhook-envelope) (Changed, breaking, 2026-08-11): Webhook bodies now carry version, id, type, created_at, data and origin.flow only, and review\.submitted is split into product-review\.submitted and company-review\.submitted.

[All Webhooks changes in the changelog](https://docs.cevoid.com/developers/changelog.md)

## Related articles

- [Webhooks via Flows](https://docs.cevoid.com/flows/webhooks.md)
- [Outbox](https://docs.cevoid.com/flows/outbox.md)
- [Cevoid API](https://docs.cevoid.com/developers/api.md)

---

Canonical: https://docs.cevoid.com/developers/webhooks