Activating and testing a webhook

Box and PrestaShop

This page applies to both box stores and PrestaShop stores.

Before you start, gather:

• a public receiving URL that accepts POST requests and responds immediately;
• the key of the event you want to receive (see the event catalogue);
• ten minutes.

Step 1: get a receiving URL

No-code tool (Make, Zapier)

This is the simplest path, and the one most Ciklik merchants follow.

1. Add a “Custom webhook” module in a new Make scenario.

2. Copy the URL Make gives you.

3. Register it for the event key you want (see step 2 below).

4. Once the first delivery has been received, click the “Redetermine data structure” button of the webhook module in Make: the event’s fields then become usable in the rest of your scenario.

The same principle applies to Zapier: create a “Catch Hook” trigger and follow the same steps.

Your own server

An address on your application that accepts a JSON POST and responds immediately is enough. To build this receiving URL, your developer will find the full request contract in Understanding a webhook delivery and the mistakes to avoid in Best practices and troubleshooting.

Capture tool

A public service such as webhook.site lets you see what a delivery looks like in two minutes, without writing any code.

Caution

The URL generated by these tools is public: anyone who knows it can read your customers’ data. Only use this method with a test account, never in production.

Step 2: activate the event

1. Choose the event key from the catalogue.

2. In Settings > Sites, open your site, click Edit, then open the Advanced tab. In the Webhooks field, add a row: the event key on the left, the receiving URL on the right. Save. You can also use the API.

3. Activation takes effect in under a minute.

Copy the key exactly

The Webhooks field does not check keys. A misspelled key (created_subcription, Created_subscription, an extra space) is saved without any error, but no delivery is ever sent. Copy the key from the catalogue. Through the API, however, an unknown key is rejected (422 error).

Do not add deleted_user or deleted_optin either: these keys are not supported.

Configuration and log

The Webhooks field of the Advanced tab lists all your registered URLs. The Settings > Advanced > Webhooks menu is not a configuration screen: it is the delivery log. Two rules to keep in mind:

• one receiving URL per event: a new URL replaces the previous one, without warning;
• your URL must never redirect, not even from HTTP to HTTPS or to add a trailing slash. On a redirect, the content of the delivery is lost.

Step 3: trigger a first delivery

Run these tests on a test customer account, never on a real customer.

What you do	Event	Delay
Create a test customer account	created_user	immediate
Create an address for that account	created_address	immediate
Edit the address of that test account	updated_address	immediate
Subscribe to the newsletter with a test e-mail address	created_optin	about 10 seconds
Place an order	created_checkoutorder, then created_checkouttransaction, then created_checkoutinvoice	about 10 seconds for the order and the transaction, 15 seconds for the invoice

Placing an order requires a real payment: use a 100% coupon if you do not want to charge a card.

One action, several deliveries

Editing an address also triggers one delivery per recent shipment and per order currently being created: this is expected. See Events: customers, addresses and opt-ins.

Reading what you receive

Here is the actual content of two first deliveries, on a test account.

created_optin.json

{
    "email": "claire.martin@example.com",
    "tenant_id": 1,
    "valid": true,
    "list_id": "9f2c4e7a1b",
    "changed": []
}

created_user.json

{
    "id": 1,
    "email": "claire.martin@example.com",
    "uuid": "cus_Qx7hR3eaEowcv1DX",
    "refp": "https://boutique.example.com/formules?refp=CLAIRE2026",
    "has_active_subscription": false,
    "info": null,
    "changed": []
}

• Fields are at the root: there is no envelope.
• changed is empty on a creation.
• The event name is not in the content: the receiving URL is what identifies it.
• The rest of the contract (field types, update cases, date and amount formats) is described in Understanding a webhook delivery.

If you receive nothing

Check, in this order:

1. your URL does respond to a POST request sent from outside;
2. it does not redirect;
3. it requires neither a password nor IP address filtering;
4. its certificate is valid and issued by a recognised authority: a self-signed certificate makes the delivery fail without leaving any trace;
5. fewer than 60 seconds have passed since activation: the configuration is cached for one minute.

If all of that is in order and still nothing arrives, head to Best practices and troubleshooting.

See also

Understanding a webhook delivery

Best practices and troubleshooting

Configuring webhooks through the API

Webhooks