> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.rushorder.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.rushorder.com/_mcp/server.

# Webhooks

Rush Order sends an HTTPS `POST` to your endpoint when an event happens, so your systems
learn about new, released, shipped and delivered orders, and received inbound deliveries,
without polling the API.

## Event types

| Event type                                                                        | Sent when                                                                                        |
| --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| [`order.whready`](/webhooks/event-reference#orderwhready)                         | An order enters the warehouse system and receives its Rush Order order number.                   |
| [`order.released`](/webhooks/event-reference#orderreleased)                       | An order is released to the warehouse for picking and packing.                                   |
| [`order.shipped`](/webhooks/event-reference#ordershipped)                         | The shipping labels for a package of an order are final: 60 minutes after its most recent label. |
| [`shipment.delivered`](/webhooks/event-reference#shipmentdelivered)               | The carrier reports a package delivered.                                                         |
| [`shipment.delivery_failed`](/webhooks/event-reference#shipmentdelivery_failed)   | A delivery attempt fails, such as no one being available.                                        |
| [`shipment.exception`](/webhooks/event-reference#shipmentexception)               | The carrier reports a problem, such as a customs hold or a return to sender.                     |
| [`shipment.tracking_expired`](/webhooks/event-reference#shipmenttracking_expired) | The carrier has stopped providing tracking updates.                                              |
| [`inbound.received`](/webhooks/event-reference#inboundreceived)                   | An inbound delivery has been received into inventory.                                            |

The event types available to your account are listed on the Webhook Subscriptions page in
Dream.

## Setup

### Enabling webhooks

Rush Order enables webhooks for each client account. Until then, the Webhook Subscriptions
page shows a notice to contact Rush Order.

### Subscriptions

Client administrators manage subscriptions on the
[Webhook Subscriptions](https://dream.rushorder.com/reports/integration/webhook-subscriptions.aspx)
page in Dream. Each subscription has a name, a destination URL and one or more event
types, and an account can have several. An event type in two subscriptions is delivered
to both.

Subscriptions can also be managed with the [webhook subscription API](https://docs.rushorder.com/api-reference/webhooks/list),
which Rush Order enables on request.

### Signing secret

Creating a subscription shows a secret that begins with `whsec_`. It is shown only once,
so store it as soon as it appears.

Rotating the secret issues a new one. For 15 minutes afterward, each delivery carries
signatures from both the new and the previous secret, which gives you time to deploy the
new secret without rejecting deliveries.

### Destination URL

An accepted URL:

* uses `https` on port 443
* has a public host name that resolves only to public IP addresses
* contains no user name or password

Redirects are not followed, and your endpoint's TLS certificate is validated.

### Testing

The page's **Test** button sends a signed `webhook.test` delivery right away. It is a
single attempt with a 10-second limit, and can be sent at most once every 10 seconds per
subscription. Its `data` holds a message.

## Next steps

* [Receiving deliveries](/webhooks/receiving-deliveries): the request format, signature verification and
  retries
* [Event reference](/webhooks/event-reference): the fields of each event, with examples