Order status callback

When an order reaches a terminal status (delivered, failed, reversed, expired) we POST this event to your callback_url.

Verify authenticity with the X-Faas-Signature header — it's the hex HMAC-SHA256 of the exact raw request body under your webhook secret (the standard Stripe/GitHub signing scheme). Respond 2xx to acknowledge; non-2xx is retried with exponential backoff, then dead-lettered. The body (and signature) are stable across retries.

Delivery constraints. Your endpoint must respond within 5 seconds (connect + headers + body timeout each). HTTP redirects are not followed — the callback_url must be the final destination. A timeout or non-2xx response triggers the retry/dead-letter path exactly as a connection error would; it never blocks order processing.

Secret rotation (rollover). During the grace window after you rotate your webhook secret, this header may carry multiple comma-separated signatures (the new and the previous secret). Treat the header as a comma-separated list and accept the request if any entry matches your secret — so you can switch from the old secret to the new one at any point in the window without dropping a webhook. Outside a rotation it is a single signature, so naive single-value verification keeps working day to day.

{
  "failure_reason": "undeliverable"
}