> For the complete documentation index, see [llms.txt](https://fez-delivery-co.gitbook.io/fezcorporate-api-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://fez-delivery-co.gitbook.io/fezcorporate-api-docs/api-endpoints/webhook/order-webhook-request.md).

# Order Webhook Request

This endpoint is defined by the client, typically specified as a callback URL during webhook registration. It is invoked whenever an order changes its state (status).

{% hint style="info" %}
This endpoint Delivers an order status change notification to the client's registered webhook endpoint.

By the time execution reaches here, the system has already confirmed that the associated order exists, that the client has a registered webhook endpoint, and that the retry limit has not been exhausted. 

The target URL is the client's own server — it may be any external system the client has configured to receive real-time order updates (e.g. their own backend, a third-party logistics platform, or an ERP). The payload is intentionally minimal: only the order reference and the new status are sent, keeping the contract stable and avoiding exposure of sensitive order internals.

       

Each request is signed using a shared secret (the client's API secret key) so the receiving server can independently verify that the notification genuinely originated from this platform and has not been tampered with in transit.

Note that the registered url is a POST route. Json body will be sent to this route and will contain <mark style="color:blue;">**orderNumber**</mark> and <mark style="color:blue;">s</mark><mark style="color:blue;">**tatus**</mark> as request body.
{% endhint %}

## Request

<mark style="color:green;">`POST`</mark> `/{{userDefinedBaseUrl}}`

#### Request Headers

| Name              | Type   | Description                                                                                                                                                                                   |
| ----------------- | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Content-Type`    | String | `application/json`                                                                                                                                                                            |
| `X-Caller-Domain` | String | `The base URL of this platform (identifies the sender).`                                                                                                                                      |
| `X-Timestamp`     | String | `Unix timestamp of when the request was signed (used for replay-attack prevention).`                                                                                                          |
| `X-Signature`     | String | HMAC-SHA256 hex digest of (orderNo + orderStatus + timestamp) signed with the client's secret key. The receiver should recompute this and reject requests where the signature does not match. |

#### Request Body

| Name                                          | Type   | Description                  |
| --------------------------------------------- | ------ | ---------------------------- |
| orderNumber<mark style="color:red;">\*</mark> | String | Your order unique ID on fez  |
| status<mark style="color:red;">\*</mark>      | String | The new status of your order |

{% tabs %}
{% tab title="200 Success" %}

```json
{
    userDefinedResponse
}
```

{% endtab %}

{% tab title="401 Unauthorized" %}

```json
{
    userDefinedResponse
}
```

{% endtab %}

{% tab title="422 Validation Error" %}

```json
{
    userDefinedResponse
}
```

{% endtab %}
{% endtabs %}

```php
<?php

$curl = curl_init();

curl_setopt_array($curl, array(
  CURLOPT_URL => '{{userDefinedUrl}}',
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => '',
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 0,
  CURLOPT_FOLLOWLOCATION => true,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => 'POST',
  CURLOPT_POSTFIELDS =>'{
    "orderNumber":"UKOOIE001F35",
    "status": "Delivered"
}',
));

$response = curl_exec($curl);

curl_close($curl);
echo $response;

```