# ShipEngine is becoming ShipStation API

Over the next few months you'll notice the ShipEngine website, documentation portal, and dashboard being rebranded as ShipStation API. For our ShipEngine customers, you don't need to take any action or change any of your integrations in any way. All endpoints will remain the same and continue to function as they always have.

To learn more about what's coming, review our [New ShipStation API page](/content/docs/new-shipstation-api/index.html).

## Setting Up Webhooks

ShipStation API allows you to subscribe to webhooks to receive real-time updates for long-running asynchronous operations. This allows your application to move on to other work while the operation is running rather than being blocked until it completes.

It also allows ShipStation API to push updates to your application rather than having your application continually poll for updates. For example, you may subscribe to the `track` webhook event to automatically receive an update anytime a tracking event occurs. Rather than continually sending a request to the `/v1/labels/:label_id/track` endpoint to see if the tracking information has been updated since the last time you checked, you can subscribe to the `track` webhook event and ShipStation API will push the notification to your application via a webhook whenever the tracking details are updated.

## Configuring Webhooks

Before you can begin receiving webhooks, you must configure your ShipStation API account with the HTTP endpoints you'd like for the webhooks to be sent to. You can do this through the [ShipStation API Dashboard](https://dashboard.shipengine.com/) or through the API.

### Requirements

You must be in the **Production** environment of the ShipStation API dashboard to set up webhooks.

### Configure Using the Dashboard

1. Log in to your [account Dashboard](https://dashboard.shipengine.com/).
2. Go to **Developer**, then **Webhooks**.
3. Click the **Add New Webhook** button.
4. Select your **Webhook Event** and enter your **Webhook URL**. You can set up multiple URLs for the same Event.
5. Click the green checkmark icon to save your webhook.

### Configure Using the API

To configure a webhook using the API, you'll need to provide a `url` and an `event` that will trigger the webhook. You'll send this data using the POST method to `/v1/environments/webhooks`. You may only configure one URL per event.

> **NOTE:**  
>  
> ### HTTP 409 Conflict  
>  
> If you create a webhook for an event that already exists, you'll receive an HTTP 409 Conflict error when your request is sent. If this occurs, be sure to review the list of webhooks and delete the existing webhook for the event before resubmitting your request.

The payload for each type of webhook event will have a unique `resource_type` which indicates which type of event triggered the webhook.

You can use the following event names and corresponding resource types in your payload when you configure a webhook through the API:

| Description | Event | Resource Type |
| --- | --- | --- |
| Batch completed | `batch` | `API_BATCH` |
| Shipment rate updated | `rate` | `API_RATE` |
| Any tracking event | `track` | `API_TRACK` |
| Carrier connected | `carrier_connected` | `API_CARRIER_CONNECTED` |
| Sales Orders imported (Beta) | `sales_orders_imported` | `API_SALES_ORDERS_IMPORTED` |
| Order Source refresh complete (Beta) | `order_source_refresh_complete` | `API_ORDER_SOURCE_REFRESH_COMPLETE` |
| A requested report is ready | `report_complete` | `API_REPORT_COMPLETE` |

#### Example Request

This example uses a `batch` event.

```
POST /v1/environment/webhooks

{
    "url": "https://example.com/batch",
    "event": "batch"
}
```

## Testing Webhooks

You can use a service like [Webhook.site](https://webhook.site/) to create temporary URLs to receive webhooks. It will allow you to observe any HTTP requests the temporary URL receives. This will allow you to see the exact payload and headers sent from our system, before your application is ready to accept it. Make sure to unregister the webhook after your testing is complete.

## Validating Webhooks

ShipStation includes a digital signature (RSA-SHA256) in all outgoing webhooks. This allows you to ensure requests received at your webhook URL were sent from our systems.

We have a [full code example](/content/docs/webhook-validation-example/index.html) that demonstrates the steps.

### Step 1: Extract the Signature Headers

Extract the three signature headers from the incoming webhook request:

- `x-shipengine-rsa-sha256-key-id`  
- `x-shipengine-rsa-sha256-signature`  
- `x-shipengine-timestamp`

If these headers are not present, you should respond with an HTTP status `404` and stop processing the request. This can help hide the existence of your webhook endpoint from anyone attempting to impersonate our service.

### Step 2: Validate the Timestamp

Verify that the timestamp in the `x-shipengine-timestamp` header is recent, in order to prevent replay attacks. Use your judgement on the age of webhooks you are willing to accept. Note that because of different server time skews, you may receive webhooks with timestamps in the future, so your code should account for that.

### Step 3: Get the Raw Request Body

**Important**: You must use the raw, unparsed request body exactly as received. Do not parse the JSON first and then re-serialize it, as this may change whitespace, property ordering, or encoding, which will cause signature verification to fail. Ensure your web server framework provides access to the unparsed body.

### Step 4: Retrieve the Public Key

Fetch the JSON Web Key Set (JWKS) from our public endpoint: [https://api.shipengine.com/jwks](https://api.shipengine.com/jwks)

The JWKS endpoint returns a standard [RFC 7517](https://tools.ietf.org/html/rfc7517) JSON Web Key Set containing our public keys. Find the key in the JWKS whose `kid` (key ID) matches the `x-shipengine-rsa-sha256-key-id` header value.

### Step 5: Verify the Signature

To verify the signature, you must first construct the _signed payload_. This is the value that was hashed using our private key to produce the signature. The signed payload is constructed by concatenating the value from the timestamp header, a literal period (`.`), followed by the raw request body.

Example:

```
2025-10-02T04:51:00Z.{"resource_url":"https://api.shipengine.com/example","resource_type":"EXAMPLE"}
```

If the signature validation fails, you should respond with an HTTP status `401`, and discard the payload without any further processing.

### Example

We've included a full working example of a NodeJS server that receives and validates webhooks, so that you can use it as a reference in your own implementation.

```
const crypto = require('crypto');

// Cache for JWKS (in production, use a proper caching mechanism)
let jwksCache = null;
let jwksCacheETag = null;

class MissingHeadersError extends Error {}
class TimestampError extends Error {}
class SignatureError extends Error {}

async function validateWebhookSignature(headers, rawBody) {
  const keyId = headers['x-shipengine-rsa-sha256-key-id'];
  const signature = headers['x-shipengine-rsa-sha256-signature'];
  const timestamp = headers['x-shipengine-timestamp'];

if (!keyId || !signature || !timestamp) {
    throw new MissingHeadersError('Missing required signature headers');
  }

const webhookTime = new Date(timestamp);
  const now = new Date();
  const ageMinutes = (now - webhookTime) / 1000 / 60;

if (Math.abs(ageMinutes) > 5) {
    throw new TimestampError(`Webhook timestamp too old or too far in future: ${ageMinutes} minutes`);
  }

const publicKey = await getPublicKey(keyId);
  if (!publicKey) {
    throw new SignatureError(`Public key not found for kid: ${keyId}`);
  }

const signedPayload = `${timestamp}.${rawBody}`;

const verify = crypto.createVerify('RSA-SHA256');
  verify.update(signedPayload, 'utf8');
  verify.end();

const isValid = verify.verify(
    publicKey,
    signature,
    'base64'
  );

if (!isValid) {
    throw new SignatureError('Invalid webhook signature');
  }

return true;
}

async function getPublicKey(keyId) {
  if (jwksCache) {
    const jwk = jwksCache.keys.find(k => k.kid === keyId);
    if (jwk) {
      return jwkToPem(jwk);
    }
  }

jwksCache = null;
  const jwks = await fetchJWKS();
  const jwk = jwks.keys.find(k => k.kid === keyId);

if (!jwk) {
    return null;
  }

return jwkToPem(jwk);
}

async function fetchJWKS() {
  const headers = {};
  if (jwksCacheETag) {
    headers['If-None-Match'] = jwksCacheETag;
  }

const response = await fetch('https://api.shipengine.com/jwks', {
    method: 'GET',
    headers
  });

if (response.status === 304 && jwksCache) {
    return jwksCache;
  }

if (!response.ok) {
    throw new Error(`Failed to fetch JWKS: ${response.status}`);
  }

jwksCache = await response.json();
  jwksCacheETag = response.headers.get('etag');

return jwksCache;
}

function jwkToPem(jwk) {
  const modulus = Buffer.from(jwk.n, 'base64');
  const exponent = Buffer.from(jwk.e, 'base64');
  const key = crypto.createPublicKey({
    key: {
      kty: 'RSA',
      n: jwk.n,
      e: jwk.e
    },
    format: 'jwk'
  });

return key;
}

function webhookValidationMiddleware(req, res, next) {
  let rawBody = '';

req.on('data', (chunk) => {
    rawBody += chunk.toString('utf8');
  });

req.on('end', async () => {
    try {
      await validateWebhookSignature(req.headers, rawBody);
      req.body = JSON.parse(rawBody);
      next();
    } catch (error) {
      console.error('Webhook validation failed:', error.message);

if (error instanceof MissingHeadersError) {
        res.status(404).send();
      } else if (error instanceof TimestampError) {
        res.status(400).json({ error: error.message });
      } else if (error instanceof SignatureError) {
        res.status(401).json({ error: 'Invalid webhook signature' });
      } else {
        res.status(500).json({ error: 'Internal server error' });
      }
    }
  });
}

const express = require('express');
const app = express();
app.post('/webhook', webhookValidationMiddleware, (req, res) => {
  console.log('Validated webhook:', req.body);
  res.status(200).send('OK');
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Webhook server listening on port ${PORT}`);
});

// How to run:
// 1. Save this entire code block into a file named server.js
// 2. npm install --save express
// 3. npm start
```

## Webhook Payloads

Example payloads for each type of webhook are provided below. You can expect to receive a message with the same structure as these examples whenever you subscribe to the corresponding event. You'll notice that each payload includes a `resource_type` and a `resource_url`. Some payloads will contain additional information as well.

When ShipStation API dispatches a webhook, we allow 10 seconds for you to acknowledge you have successfully received the payload (your listener should return a 2xx response to us). If we don't receive an acknowledgement within 10 seconds, the system will put the payload back into the queue and make a maximum of **two additional attempts** to dispatch the given payload. These attempts are typically separated by 30 minutes. However, this can swap to other timing intervals under certain conditions. If all three attempts receive no response, the event will be removed from the dispatch queue.

### Example Batch Event Payload

```
{
  "resource_url": "https://api.shipengine.com/v1/batches/se-1013119",
  "resource_type": "API_BATCH"
}
```

### Example Track Event Payload

```
{
  "resource_url": "https://api.shipengine.com/v1/tracking?carrier_code=usps&tracking_number=9400111298370264401222",
  "resource_type": "API_TRACK",
  "data": {
    "label_url": null,
    "tracking_number": "9400111298370264401222",
    "status_code": "IT",
    "carrier_detail_code": null,
    "status_description": "In Transit",
    "carrier_status_code": "NT",
    "carrier_status_description": "Your package is moving within the USPS network and is on track to be delivered the expected delivery date. It is currently in transit to the next facility.",
    "ship_date": "2020-06-30T16:09:00",
    "estimated_delivery_date": "2020-07-06T00:00:00",
    "actual_delivery_date": null,
    "exception_description": null,
    "events": [
      {
        "occurred_at": "2020-07-02T00:00:00Z",
        "carrier_occurred_at": "2020-07-02T00:00:00",
        "description": "In Transit, Arriving On Time",
        "city_locality": "",
        "state_province": "",
        "postal_code": "",
        "country_code": "",
        "company_name": "",
        "signer": "",
        "event_code": "NT",
        "event_description": "In Transit, Arriving on Time",
        "carrier_detail_code": null,
        "status_code": null,
        "latitude": null,
        "longitude": null
      },
      {
        "occurred_at": "2020-06-30T20:09:00Z",
        "carrier_occurred_at": "2020-06-30T16:09:00",
        "description": "Shipment Received, Package Acceptance Pending",
        "city_locality": "VERSAILLES",
        "state_province": "KY",
        "postal_code": "40383",
        "country_code": "",
        "company_name": "",
        "signer": "",
        "event_code": "TM",
        "event_description": "Shipment Received, Package Acceptance Pending",
        "carrier_detail_code": null,
        "status_code": null,
        "latitude": 37.8614,
        "longitude": -84.6646
      }
    ]
  }
}
```

### Example Rate Event Payload

```
{
  "resource_url": "https://api.shipengine.com/v1/shipments/se-2120221/rates",
  "resource_type": "API_RATE"
}
```

### Example Carrier Connected Event Payload

```
{
  "resource_url": "https://api.shipengine.com/v1/carriers/se-1234",
  "resource_type": "API_CARRIER_CONNECTED"
}
```

### Example Sales Order Imported Event (Beta)

```
{
  "resource_url": "https://api.shipengine.com/v-beta/sales_orders",
  "resource_type": "API_SALES_ORDERS_IMPORTED",
  "data": [
  {
    "sales_order_id": "2078df4d-49c1-53da-837a-ad2781b782e0",
    "external_order_id": "611699195963",
    "external_order_number": "SH21622",
    "order_source":
      {
        "order_source_id": "4e4af80f-6974-48b6-b88f-e46f1c2a0b28",
        "order_source_nickname": "Shippity Shop Shopify",
        "order_source_code": "shopify",
        "order_source_friendly_name": "Shopify",
        "refresh_info":
        {
          "status": "idle",
          "last_refresh_attempt": "2018-09-12T19:29:21.657Z",
          "refresh_date": "2018-09-12T19:29:16.837Z"
        },
        "active": true
      },
      "sales_order_status":
      {
        "payment_status": "paid",
        "fulfillment_status": "unfulfilled",
        "is_cancelled": false
      },
      "order_date": "2018-09-12T19:18:12Z",
      "created_at": "2018-09-12T19:29:18.69Z",
      "modified_at": "2018-09-12T19:29:18.69Z",
      "payment_details":
      {
        "subtotal":
        {
          "currency": "usd",
          "amount": 40.0
        },
        "estimated_shipping":
        {
          "currency": "usd",
          "amount": 0.0
        },
        "estimated_tax":
        {
          "currency": "usd",
          "amount": 0.0
        },
        "grand_total":
        {
          "currency": "usd",
          "amount": 40.0
        }
      },
      "customer":
      {
        "name": "Amanda Miller",
        "phone": "555-555-5555",
        "email": "amanda.miller@email.com"
      },
      "bill_to":
      {
        "email": "amanda.miller@email.com",
        "address":
        {
          "name": null,
          "phone": null,
          "company_name": null,
          "address_line1": "",
          "address_line2": null,
          "address_line3": null,
          "city_locality": null,
          "state_province": null,
          "postal_code": null,
          "country_code": null,
          "address_residential_indicator": "no"
        }
      },
      "ship_to":
      {
        "name": "Amanda Miller",
        "phone": "555-555-5555",
        "address_line1": "525 S Winchester Blvd",
        "city_locality": "San Jose",
        "state_province": "CA",
        "postal_code": "95128",
        "country_code": "US",
        "address_residential_indicator": "yes"
      },
      "sales_order_items": [
      {
        "sales_order_item_id": "6f8f3f51-7a5a-50b2-a842-d6e89a5b5b26",
        "line_item_details":
        {
          "name": "Bubble Popper 4XL",
          "sku": "BUB-1-T",
          "weight":
          {
            "value": 2.8,
            "unit": "ounce"
          }
        },
        "ship_to":
        {
          "name": "Amanda Miller",
          "phone": "555-555-5555",
          "address_line1": "525 S Winchester Blvd",
          "city_locality": "San Jose",
          "state_province": "CA",
          "postal_code": "95128",
          "country_code": "US",
          "address_residential_indicator": "yes"
        },
        "requested_shipping_options":
        {
          "shipping_service": null,
          "ship_date": null
        },
        "price_summary":
        {
          "unit_price":
          {
            "currency": "usd",
            "amount": 40.0
          },
          "estimated_tax":
          {
            "currency": "usd",
            "amount": 0.0
          },
          "estimated_shipping": null,
          "total":
          {
            "currency": "usd",
            "amount": 40.0
          }
        },
        "quantity": 1,
        "is_gift": false
      }]
  
  }
}
```

### Example Order Source Refresh Complete Event (Beta)

```
{
  "resource_url": "https://api.shipengine.com/v-beta/stores/se-0bdf1f26-5708-4e0b-a548-fd2a5720779f",
  "resource_type": "API_ORDER_SOURCE_REFRESH_COMPLETE"
}
```

### Example Report Complete Event Payload

```
{
  "resource_url": "https://api.shipengine.com/adjustments/se-0bdf1f26-5708-4e0b-a548-fd2a5720779f",
  "resource_type": "API_REPORT_COMPLETE"
}
```