Deliver a signed inventory, order or fulfillment event to SKUU

post

https://{skuuWebhookHost}/webhooks/connect/{shop_slug}

SKUU-hosted endpoint called by the merchant for each supported event:

inventory.updated carries one absolute location-level stock change;
order.created carries one paid consumer order with the selected
fulfillment location per line; and
fulfillment.shipped carries one shipped package and its tracking.

Orders carrying the exact skuu_ship tag are accepted without routing to
prevent an injection loop. Webhook event_id is the durable per-shop
deduplication key. An exact retry reuses the same event ID, raw body and
embedded timestamps.

IMPORTANT 200 SEMANTICS: 200 is a delivery acknowledgement, not proof that
the business state changed. Signature-valid deliveries that are invalid,
duplicate, stale, loop echoes or otherwise inapplicable may be acknowledged
without a mutation. The sender must treat any 200 as terminal. Only a
transient processing failure produces a retryable 5xx.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Path Params

shop_slug

string

required

length ≥ 1

Environment-specific merchant slug assigned by SKUU.

Body Params

Maximum raw body size is 512 KiB (524,288 bytes). The signature covers the
exact bytes on the wire and is verified before JSON parsing. Validate against
the closed schema selected by event before serializing and signing: a 200
response acknowledges delivery but does not by itself prove schema acceptance.

The binding Phase-1 sender object and receiver validation are intentionally
closed to the fields below. Additional fields require a contract revision.

spec_version

const

enum

required

Contract envelope version as the JSON string "1"; JSON number 1 is invalid.

Allowed:

event

const

enum

required

Exact case-sensitive Phase-1 literal inventory.updated; underscore forms such as inventory_updated are invalid.

Allowed:

event_id

string

required

length between 1 and 255

(?=^[^\u0000-\u001F\u007F]+$)(?=^\S(?:[\s\S]*\S)?$)

Non-empty string without surrounding whitespace.

occurred_at

date-time

required

^\d{4}-\d{2}-\d{2}[Tt]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:[Zz]|[+-]\d{2}:\d{2})$

RFC 3339 event timestamp with seconds and timezone; no more than five minutes ahead of SKUU receipt time.

data

object

required

The binding Phase-1 inventory payload is intentionally closed. Additional
request fields require a contract revision even if the receiver ignores them.

Responses

200

Empty acknowledgement. This means either:

a valid supported event completed its applicable durable SKUU pipeline;
a duplicate, stale, loop echo, timestamp-conflicting or otherwise
inapplicable delivery was acknowledged without a new business mutation;
a signature-valid but malformed, unknown, or invalid request was logged
and permanently discarded.

It does not prove that inventory, order or fulfillment state changed.
Do not retry a 200 response.

401Uniform authentication failure. Unknown slug, non-Connect shop, missing configured secret, missing signature, malformed signature, and signature mismatch all return exactly the same response so callers cannot enumerate configured merchants.

413Raw request body exceeds 512 KiB. Size is checked before authentication, first from a numeric Content-Length when present and then while streaming chunks with a running cap. This is a permanent rejection.