Webhook API

Connections posts JSON to the HTTPS URL saved in reseller settings. The add-on is EUR 29 per month, includes one free month per portal, and is included on Enterprise. The older order.ready shop event is part of the shop API on Professional and Enterprise and does not require this add-on.

Events

order.created — an order was committed.
order.status_changed — the order status changed.
ticket.replied — staff posted a ticket reply.
wallet.low — a customer credit balance crossed from above 10 credits to 10 or below.
webhook.test — the “send test event” button.
order.ready — the file is ready to download. One attempt, same signature, not gated by Connections.

Payload

{
  "id": "evt_…",
  "type": "order.created",
  "created": "2026-10-27T12:00:00.000Z",
  "data": { "orderId": "…", "orderRef": "ORD-1-001", "status": "RECEIVED" }
}

Each delivery keeps the same id and body when it is retried. The timestamp header changes.

Signature

Every POST sends these headers:

X-Fixwave-Event — the event name
X-Fixwave-Timestamp — unix seconds
X-Fixwave-Signature — v1= plus HMAC-SHA256 of {timestamp}.{rawBody} using the webhook secret

Compare the hex digest in constant time. Reject a timestamp that is more than a few minutes off. The URL must be public HTTPS. Private and loopback addresses are refused and are not retried.

Retries

A 2xx response is success. Anything else, including a timeout or a redirect, is retried up to 5 times: after 1 minute, 5 minutes, 15 minutes, and 1 hour. Delivery rows older than 30 days are deleted. The reseller settings page shows the last 50 attempts.

Zapier

In Zapier, choose Webhooks by Zapier and the Catch Hook trigger.
Copy the hook URL Zapier shows.
In the portal, open reseller settings, paste that URL as the webhook, and save.
Click “Send test event”. Zapier’s test step should show webhook.test.
Map type and data in the next Zapier step.

All docs