Webhooks notify applications when specific events occur on a BigCommerce store. For example, when:
This article is an overview of webhook behavior on BigCommerce. For webhook API reference, see API Reference > Webhooks. For webhook event reference, see Webhook Events. For a step-by-step tutorial on creating webhooks for certain store events, see the Webhooks Tutorial.
BigCommerce offers webhook delivery for the following endpoint types:
BigCommerce automatically deletes registered webhooks on app uninstall to avoid accumulating unused webhooks.
If you manually delete an API account from your store’s control panel, the webhooks associated with the account will also be deleted. For information on manually deleting a webhook, see Delete a Webhook.
To ensure webhook callback requests are secure, BigCommerce takes the following precautions:
BigCommerce will send the specified headers when making callback requests to the destination server - this allows webhook destination URIs to be secured with basic authentication.
The hash field is a SHA1 hash of event metadata, intended only to uniquely identify the event that triggered the webhook dispatch. If a hook fires twice for the same event, both request bodies should have the same hash. For additional HTTPS security mechanisms, see HTTPS Webhooks Overview.
No 200 response from the Create a webhook endpoint
Unable to view your webhook
Webhooks created with one token are not visible when you retrieve webhooks using a different token. To view your webhook, use the same account token that created the webhook.
Duplicate webhook events
Duplicate webhooks can happen. For this reason, apps should use idempotent operations to avoid significant unintended side effects. Idempotent operations allow multiple calls without changing the result. A way to ensure webhook events are idempotent is to create a temporary “blacklist” array to store the hash of webhooks that have already been received or handled. When you receive a webhook, you can compare the hash of the received event to the list. If the hash has already been handled, you can ignore the event.
Below is a collection of third-party tools that can be used to aid in the development, testing, and debugging of webhooks: