Webhooks and status updates

Use webhooks as notifications, then reconcile important state through authenticated API or dashboard reads.

Configure the endpoint

Add an HTTPS webhook URL in merchant integration settings. Shioja validates the URL and blocks unsafe local or private destinations before sending delivery-status payloads.

Respond quickly

Return a 2xx response after durable receipt. Move email, inventory, customer messaging, and analytics into an internal queue so temporary downstream failures do not block acknowledgement.

Process safely

Treat the order ID and status as idempotent update inputs. Store the last processed status, ignore duplicates, and permit only valid forward transitions in your own system.

Security

Use an unguessable HTTPS path, allow only POST, limit body size, redact personal data from logs, and compare payload order ownership before changing customer-visible state. Contact Shioja support for the current webhook authentication policy before relying on headers not documented here.

Recovery

Build a periodic reconciliation job for orders that remain unchanged beyond your expected window. Webhooks reduce latency; they should not be your only source of recovery.