Webhooks

Webhooks

Webhooks push real-time event notifications to your server when things happen in Inventory Pro — items received, orders created, stock levels changed. Instead of polling the API, register a URL and the system POSTs events to it.

Endpoints

All webhook endpoints require the Webhook Administration permission (SecurityID 370).

Subscription Model

Each subscription belongs to the API client that created it. You can only see and manage your own subscriptions.

List Response

{
  "value": [
    {
      "rec": 5,
      "name": "ERP Sync",
      "url": "https://erp.example.com/webhooks/inventory",
      "events": "inventory.received,inventory.issued",
      "payloadMode": 1,
      "active": true,
      "disableType": 0,
      "failureCount": 0,
      "failureDays": 0,
      "lastSuccess": "2025-06-01T14:30:00Z",
      "lastFailure": null,
      "lastError": null,
      "created": "2025-01-10T09:00:00Z",
      "modified": "2025-06-01T14:30:00Z"
    }
  ],
  "totalCount": 3,
  "page": 1,
  "pageSize": 25,
  "pageCount": 1,
  "hasMore": false
}

Subscription Fields

Create a Subscription

POST /Webhook

Request Body

{
  "name": "ERP Sync",
  "url": "https://erp.example.com/webhooks/inventory",
  "events": "inventory.received,inventory.issued,item.created",
  "payloadMode": 1,
  "active": true,
  "headers": {
    "X-Custom-Header": "my-value"
  }
}

Required Fields

Optional Fields

Response

{
  "rec": 5,
  "secret": "whsec_a1b2c3d4e5f6..."
}

The signing secret is returned only on creation. Store it securely — you’ll need it to verify webhook signatures.

Update a Subscription

PUT /Webhook/5

Same body format as create. Include all fields you want set — the entire subscription is replaced (except the secret, which is only updated if you provide a new value).

Returns 200 on success, 404 if the subscription doesn’t exist or isn’t yours.

Delete a Subscription

DELETE /Webhook/5

Permanently removes the subscription and its delivery history.

Returns 200 on success, 404 if not found.

Test a Subscription

POST /Webhook/5/test

Sends a test event to your endpoint. The subscription must be active.

Response

{
  "success": true,
  "statusCode": 200,
  "duration": 342.5,
  "errorMessage": null,
  "payload": "{\"event\":\"test\",\"data\":{...}}"
}

Delivery Log

GET /Webhook/5/log?page=1&pageSize=25

View the delivery history for a subscription.

Response

{
  "value": [
    {
      "rec": 1042,
      "event": "inventory.received",
      "reference": "RecNo:15234",
      "statusCode": 200,
      "success": true,
      "attempt": 1,
      "duration": 285.3,
      "errorMessage": null,
      "payloadSize": 1842,
      "created": "2025-06-01T14:30:00Z"
    }
  ],
  "totalCount": 156,
  "page": 1,
  "pageSize": 25,
  "pageCount": 7,
  "hasMore": true
}

Verifying Signatures

Every webhook delivery includes an HMAC-SHA256 signature in the X-Webhook-Signature header, computed from the raw request body using your subscription’s signing secret.

Verification Example (C#)

using System.Security.Cryptography;
using System.Text;

public bool VerifySignature(string body, string signature, string secret)
{
    using (var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret)))
    {
        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(body));
        var expected = "sha256=" + BitConverter.ToString(hash)
            .Replace("-", "").ToLowerInvariant();
        return signature == expected;
    }
}

Verification Example (PowerShell)

function Test-WebhookSignature {
    param([string]$Body, [string]$Signature, [string]$Secret)

    $hmac = New-Object System.Security.Cryptography.HMACSHA256
    $hmac.Key = [Text.Encoding]::UTF8.GetBytes($Secret)
    $hash = $hmac.ComputeHash([Text.Encoding]::UTF8.GetBytes($Body))
    $expected = "sha256=" + [BitConverter]::ToString($hash).Replace("-","").ToLower()
    return $Signature -eq $expected
}

Always verify signatures before processing webhook payloads to ensure the request came from Inventory Pro.

Retry Behavior

Failed deliveries (non-2xx response or timeout) are retried with exponential backoff. After repeated failures, the subscription is automatically disabled (disableType = 1). Re-enable it by updating the subscription with active: true after fixing your endpoint.

Event Types

Events follow the pattern resource.action. Subscribe to specific events.

Available events vary by deployment. Common events:

Your instance’s Swagger documentation lists the full set of events available for subscription.

Permissions

All webhook operations require the Webhook Administration permission (SecurityID 370).