Webhooks
Receive signed delivery events
Configure a webhook URL and secret in the partner portal, then validate every X-Luban-Signature before accepting an event.
Delivery events
Normal and bulk orders use separate event names.
| Event | Meaning |
|---|---|
order.delivered | A standard order delivered successfully. |
bulk_order.delivered | A bulk order delivered all requested items. |
bulk_order.completed | A bulk order reached a terminal state with final totals. |
Verification rules
Webhook delivery is considered successful only when your endpoint returns HTTP 2xx.
expected = HMAC_SHA256(raw_request_body, webhook_secret)
compare_constant_time(expected, X_Luban_Signature)Do not parse first
Calculate the signature against the exact raw request body, then parse the JSON only after successful verification.