API

Webhooks

A webhook is an HTTP request that FoodSoul sends to your system's address when an event occurs in your account: a new order, status change, review, and others.

A subscription with an address and events is created using the method:

POST Create a webhook subscription

The address is the URL from the subscription, the method is POST.

Format, signature, and repetitions

Webhook request body. Each request is a POST with Content-Type: application/json to the subscription URL. The URL must start with https.
Headers:

  • X-Webhook-Event — event code
  • X-Webhook-ID — event_uuid
  • X-Webhook-Signature — sha256= and HMAC-SHA256 of the original request body in hex, using the branch secret (webhooks_subscriptions.generate_secret).
    Verify the signature against the original body before parsing JSON: hash_equals(hash_hmac('sha256', $body, $secret), substr($signature, 7)). There is no timestamp in the signature; the channel is protected by HTTPS.

Delivery is considered accepted with any 2xx response within 10 seconds. Redirects are not followed. Otherwise, delivery is retried: 7 attempts — first immediately, then after 1, 5, 15, 60, 180, and 360 minutes. All attempts for a single delivery use the same X-Webhook-ID. Resending from the log (webhooks_logs.resend) uses the same X-Webhook-ID — use it to skip already processed deliveries.

20 consecutive failed deliveries disable the subscription (blocked), and both the owner and the account system administrator receive an email. webhooks_subscriptions.unblock re-enables the subscription.

The body contains event data: client, review, and order card are sent in full. Bonus balance is not included: it is shared across the network pool and must be retrieved via API.

Headers

X-Webhook-Eventstringrequired

Example: order.created

X-Webhook-IDstringrequired

Example: 5f0c6b1e-6a1d-4c1e-9d6b-3a7f0e2b8c41

X-Webhook-Signaturestringrequired

Example: sha256=9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

Events

  • client.registered
  • client.updated
  • client.bonuses_changed
  • order.created
  • order.status_changed
  • order.payment_status_changed
  • feedback.created
  • courier.assigned
  • item.stop_list_changed
  • branch.work_status_changed

Request body

object (WebhookPayload)
eventstringrequired

Values:client.registeredclient.updatedclient.bonuses_changedorder.createdorder.status_changedorder.payment_status_changedfeedback.createdcourier.assigneditem.stop_list_changedbranch.work_status_changed

Example: order.status_changed

event_uuidstringrequired

Example: 5f0c6b1e-6a1d-4c1e-9d6b-3a7f0e2b8c41

date_creationstring (DataTimeFormatSQL) required

Example: 2024-05-02 08:31:16

branch_idintegerrequired

Example: 8412

dataoneOfrequired
One of the options
object (WebhookDataClientRegistered)

client.registered — new phone number or first account login in this branch

client_branch_profile_idintegerrequired

Example: 730112

namestringcan be null

Example: John Doe

phonestringrequired

Phone number in international format, without formatting

Example: +79114579423

genderstringcan be null

Values:womanman

Example: man

date_of_birthstringcan be null

Date of birth in Y-m-d format

Example: 1982-01-03

Example body

{
  "event": "order.status_changed",
  "event_uuid": "5f0c6b1e-6a1d-4c1e-9d6b-3a7f0e2b8c41",
  "date_creation": "2024-05-02 08:31:16",
  "branch_id": 8412,
  "data": {
    "client_branch_profile_id": 730112,
    "name": "John Doe",
    "phone": "+79114579423",
    "gender": "man",
    "date_of_birth": "1982-01-03"
  }
}

Your system's response

2XX

Accepted

default

Не принято, доставка повторяется