An order was delivered

webhook

order.fulfilled

Fires when an order is delivered and its reserved funds are captured. data.status is
always fulfilled. The artifacts (codes, PINs, activation values) are not in the payload —
reveal them with POST /api/v1/orders/{orderId}/fulfillment, then hand them to your
customer. Never mark an order delivered in your system from anything but this verified
event or a fulfilled status read from the API.

Delivery contract — every Xegora webhook is delivered the same way; see order.processing.

Payload

Envelope for order.fulfilled — the order was delivered and its funds captured. Artifacts are revealed over the API, never included here.

uuid

required

Stable event id (UUID), derived from the order and the event type. The X-Xegora-Event-Id header carries the same value without dashes — dedupe on the header form.

type

const

enum

required

Allowed:

occurredAtUtc

date-time

required

data

object

required

The order snapshot every order event carries.

Headers

X-Xegora-Event-Id

string

required

^[0-9a-f]{32}$

The event's stable unique id — your deduplication key, identical on every retry. It is the envelope's id without dashes (32 lowercase hex characters), and it is the exact string signed inside X-Xegora-Signature.

X-Xegora-Timestamp

string

required

^[0-9]+$

Unix seconds at signing time — your freshness check. Reject deliveries more than 5 minutes from your clock.

X-Xegora-Signature

string

required

^v1=[0-9a-f]{64}$

v1= followed by 64 lowercase hex characters: HMAC-SHA256 over the UTF-8 string {X-Xegora-Timestamp}.{X-Xegora-Event-Id}.{raw body}, keyed with your endpoint's xgwh_… signing secret. Verify over the raw request bytes with a constant-time comparison.

X-Xegora-Delivery-Contract

const

enum

required

The delivery-contract version — currently always xegora-webhook-at-least-once-v1.

Allowed:

Response

200

Acknowledged — any 2xx accepts the event. Non-2xx responses and timeouts trigger the retry schedule described under order.processing.