Webhooks
Have InventoryFlo call your server when stock moves, a count completes or an order is received. Signed, retried and logged.
2 min read
Add an endpoint
- Go to Settings → Integrations & developers → Webhooks and choose Add endpoint (Pro plan; owners by default).
- Enter the Endpoint URL (HTTPS, publicly reachable), an optional Description, and tick the Events you want.
- Copy the signing secret (
whsec_…) now: it is shown once. Afterwards the page only shows its last characters. - Use Send test event to check your server answers.
Up to 10 endpoints per organization.
Events
| Event | Sent when |
|---|---|
stock.below_reorder_point | A variant falls below its reorder point (at most once a day per variant). |
stock.movement_posted | Any stock movement is posted. |
purchase_order.received | Goods are received on a purchase order. |
stock_count.completed | A stock count is completed. |
pick_list.completed | A pick list is completed. |
shopify.order_received | A Shopify order is applied to stock. |
item.created | An item is created. |
item.updated | An item is changed. |
Each delivery is a JSON POST with id, type, createdAt, organizationId and data. Retries and resends keep the same id: use it to ignore duplicates.
Verify the signature
Every request carries InventoryFlo-Timestamp (Unix seconds) and InventoryFlo-Signature: v1=<hex>, plus InventoryFlo-Event-Id, InventoryFlo-Event-Type and InventoryFlo-Delivery-Id.
- Compute HMAC-SHA256 of
{timestamp}.{raw request body}with your endpoint secret, as lower-case hex. - Compare it with each
v1=value in the signature header. After Rotate secret, the old secret keeps signing for 24 hours, so the header can carry two values (newest first). - Reject requests whose timestamp is more than 5 minutes old.
Retries, log and automatic pause
Answer with a 2xx status within 10 seconds; anything else (redirects included) is a failure. Failed deliveries are retried up to 10 times over about 22 hours (30 s, 2 min, 10 min, 30 min, then 1, 2, 4, 6 and 8 hours).
The Delivery log shows every attempt with its response, and lets you Resend. After 20 failures in a row spread over at least 12 hours, the endpoint turns itself off (Off after repeated failures) and owners get an email. Fix your server, then Turn on again. If the organization leaves Pro, endpoints are kept but paused.