DocsWebhooks API
Webhook endpoints for receiving order notifications from external platforms to trigger download fulfilment. Continuata does not currently send outbound webhooks to your servers.
Incoming Webhooks
These endpoints receive webhooks from external platforms to trigger download token generation:
Shopify Orders
POST /webhooks/{orgId}/shopify
Receives order completion notifications from Shopify stores.
WooCommerce Orders
POST /webhooks/{orgId}/woocommerce
Handles order completions from WooCommerce WordPress sites.
Stripe Payments
POST /webhooks/stripe
Processes successful payments from Stripe checkout sessions.
FastSpring Orders
POST /webhooks/{orgId}/fastspring
Processes order completions from FastSpring (Contextual).
FastSpring Classic Orders
POST /webhooks/{orgId}/fastspring-classic
Processes custom notifications from FastSpring Classic (Springboard) stores.
VibraCart Pro Orders
POST /webhooks/{orgId}/vibracartpro
Receives order notifications from VibraCart Pro stores.
Download Completion (internal)
POST /webhooks/{orgId}/download-complete
Called by the Continuata downloader (browser or Bridge) at the end of a session to mark the token as used and write an activity log entry. You don't normally call this yourself — it's documented for completeness.
Webhook Security
Signature Verification
Each incoming webhook is verified using the sending platform's own mechanism. Configure the matching secret under Settings → Integrations:
| Platform | Verification |
|---|---|
| Shopify | X-Shopify-Hmac-Sha256 header — base64 HMAC-SHA256 of the raw body, using your store's signing secret |
| WooCommerce | X-WC-Webhook-Signature header — base64 HMAC-SHA256 of the raw body, using your shared secret |
| Stripe | Stripe-Signature header — platform-managed by Continuata |
| FastSpring | X-FS-Signature header — HMAC-SHA256 with your per-org secret |
| FastSpring Classic | X-Security-Data + X-Security-Hash headers — MD5(data + private key) |
| VibraCart Pro | Shared secret in the webhook URL's secret query parameter (timing-safe compare) |
| Download Completion | The download token in the request body acts as the capability |
All signature comparisons are constant-time, and duplicate deliveries are de-duplicated per order and product.
Fulfilment Rules
- Undeliverable products hold the order. If an order's SKU maps to a draft product or one with no live version, no purchase, customer, download token, or email is created. The webhook is still acknowledged with a 200 (so the store doesn't retry forever) and the delivery is recorded as held in Logs → Webhooks with the SKU and reason. Publish the product, then re-deliver or record the sale manually.
- Fulfilment runs off the response path for FastSpring (Classic) and VibraCart Pro: orders are acknowledged immediately, the webhook log shows Pending until fulfilment completes, then Success or Error based on whether the customer actually got their files. A redelivery of an order whose receipt never went out re-sends the missing receipt instead of being skipped as a duplicate.
- Unmatched SKUs are surfaced, not alerted. A delivery containing an unknown SKU is flagged on the webhook log and counted in the Purchases page's unmatched-SKU chip; an alert email is only sent when an entire order fails to fulfil.