01Delivery headers
Header names are always lowercase:
| Header | Value |
|---|---|
| webhook-id | The endpoint id (UUID) — constant across all deliveries of that endpoint. |
| webhook-delivery-id | The delivery id (UUID) — the primary dedupe key: every retry of the same delivery repeats it, while a manual replay creates a new one. |
| webhook-event-id | The textual event identity — e.g. mwh:order-created:<tenant>:<order> — constant across retries and replays. Rare exception: events are kept 14 days while deliveries are kept 30, so a delivery manually replayed after its event row was purged carries the raw event UUID in this header. |
| webhook-event-type | The event type — same value as type in the payload (or ping for the test event). |
| webhook-timestamp | Unix seconds as a decimal string — the signing time of THIS attempt. |
| webhook-signature | v1=<hex> where hex = HMAC-SHA256 over ${timestamp}.${endpoint_id}.${event_id}.${delivery_id}.${body} using the endpoint secret. |
02Remaining headers and response rules
- Content-Type: application/json — the body is the payload itself as JSON.
- User-Agent: YallaBuy-Webhooks/1.0 — use it to recognize platform traffic in your firewall.
- The platform waits at most 10 seconds for your response on each attempt — beyond that the attempt is classified TIMEOUT.
- Any 2xx response settles the delivery as successful — the body does not matter.
- Your response body is ignored entirely: up to 64 KB is drained and never parsed — a short 2xx is enough.
COMPLETE YOUR INTEGRATION