Webhooks
Register and manage webhook subscriptions for return events. Each delivery is signed with HMAC-SHA256 so you can verify authenticity.
Supported event types:
| Event | When it fires |
|---|---|
return.created |
A new return request is received and processed |
return.updated |
A return’s status or data changes (e.g. after disposition) |
return.cancelled |
A return is cancelled |
Verifying signatures:
Each delivery includes X-Gierd-Signature and X-Gierd-Timestamp headers.
signing_secret is returned once, when you create the webhook subscription
— store it then, since it isn’t shown again. Compute the expected signature
and compare:
signed_payload = "#{timestamp}.#{raw_request_body}"expected = HMAC-SHA256(key: signing_secret, message: signed_payload)actual = X-Gierd-Signature header value after "v1="Reject deliveries where X-Gierd-Timestamp is more than 5 minutes old.