ikas store webhook (public)
POST/api/hooks/store/:token
ikas's webhook envelope {id, scope, merchantId, data, signature}
(doc 81 §3.3). data is a JSON string; signature is hex
HMAC-SHA256 of it keyed by the app's client secret. A bad signature
for a connected store is 401; everything that retrying cannot fix
(unknown url, unreadable body, ignored scope, duplicate) is 200 —
ikas bans an app whose delivery error rate climbs. Orders are mirrored
without national id, tax number, street address or IP.
Request
Responses
- 200
- 401
Accepted, or acknowledged with nothing to do.
The signature does not verify.