Webhooks with payload in Shoptet API

All API users can now receive the full entity data directly in webhook notifications. Until now, a webhook only told you that something happened, and your application had to call the corresponding API endpoint to find out what changed. With payload delivery, the notification body carries the complete entity, so you can:

• process orders, invoices, products, or customers as soon as the notification arrives, without a follow-up API call
• reduce the number of requests your integration sends to the Shoptet API
• keep your integration in sync with the shop in near real time

For the full list of events and the payload format, see the webhooks documentation and the webhook event types.

How to enable payload delivery

Register a new webhook, or update an existing one, with "sendPayload": "full":

{
  "data": [
    {
      "event": "order:create",
      "url": "https://myapplication.tld/orders.php",
      "sendPayload": "full"
    }
  ]
}

The notification then contains an additional payload field with the same data as the corresponding GET detail endpoint, with all include parameters applied:

{
  "eshopId": 1,
  "event": "order:create",
  "eventCreated": "2026-09-29T10:00:00+0200",
  "eventInstance": "2026000123",
  "payload": {
    "data": {
      "order": { ... }
    }
  }
}

Set sendPayload to null, or omit it, to keep the current behaviour and receive only the event metadata.

Supported events

Payload delivery is available for the create and update events of the following entities:

• Catalog and content — brand, category, product, sectionArticle
• Orders and documents — order, invoice, proformaInvoice, creditNote, deliveryNote, proofPayment
• Customers and pricing — customer, discountCoupon, quantityDiscount

Mass webhooks (*:massCreate, *:massUpdate, *:massDelete) and delete events do not support payload.

Good to know

• If the payload cannot be fetched at delivery time, the notification is still sent without the payload field. Keep the detail endpoint as a fallback in your handler.
• Webhook registration (POST /api/webhooks, PATCH /api/webhooks/{id}) now checks that the addon or private token has permission for the endpoint group that supplies the event’s data. Otherwise the registration is rejected with an authorization error.
• When a token loses permission for an endpoint group, webhooks for the affected events are automatically de-registered. Restoring the permission does not re-create them; register the webhook again.
• Webhook signing (Shoptet-Webhook-Signature) works the same way: the signature is calculated over the whole notification body, including the payload.

---

What we plan in the upcoming days:

New features and improvements in progress, e.g.:

• Payload delivery for stock:movement
• Payload delivery for pricelist:create and pricelist:update
• Payload delivery for salesChannel:create and salesChannel:update

Please note: The plan above is subject to change due to unexpected events or changes in priorities — we do not commit to deliver these outputs and outcomes. Thank you for your understanding.

---

If you have any questions, feedback or requests, please do not hesitate to contact us on api@shoptet.cz.

Post navigation