Shop integration callbacks

These calls go straight from the API to URLs the shop provides. They are not webhook subscriptions: they do not appear in the delivery logs and, except the order success URL, are not retried.

Order success URL (urls.success)

The urls.success given at order creation receives the order_confirmed payload (isBooking: false, no services[].tags) through the gateway, so the delivery rules apply. Specifics:

• Sent when the order is validated (subject to the shop's webhook_delay) and when an admin starts it with "validate external shop". Requires the order's cartSecureKey.
• The response is read: shopifyOrderId (top level or under data) is saved as the order's externalOrderId.

Customer data update (urls.sendData)

Sent when the customer edits their identity during checkout.

PATCH <urls.sendData>
Content-Type: application/json
Accept: application/json

Not sent when none of the four fields changed. No signature, 10 s timeout, no retry.

Product removal (urls.deleteProduct)

Sent when the customer removes a product from their order, once per removed line (grouped lines included).

PATCH <urls.deleteProduct>
Content-Type: application/json

No signature, no retry. The response is not read.

Discount code check (shop.discountCodeWebhookUrl)

This one is more an API endpoint than a webhook endpoint as we check response

Sent when a customer enters a code GreenLeaze does not know, if the shop has both a discountCodeWebhookUrl and a discountCodeWebhookSecret.

POST <discountCodeWebhookUrl>
Content-Type: application/json
X-Webhook-Signature: base64(HMAC_SHA256(discountCodeWebhookSecret, rawBody))

{ "discountCode": "SUMMER10" }

Expected response when the code is valid (any other answer means "unknown code"):

GreenLeaze then imports the code as an active code on every product.