API webhooks

Register webhook endpoints in Settings → API → Webhooks to receive events instead of polling.

Events

Event	Fires when
application.submitted	A wholesale application arrives
application.approved / application.rejected	A decision is made
credit.checkout_blocked	An order was blocked at checkout (company, amount, available)
credit.limit_changed	A limit or temporary limit changes
hold.applied / hold.lifted	Any hold starts or ends (manual or automatic)
ledger.entry_created	Any ledger entry (orders, payments, adjustments)
reconciliation.drift	Nightly reconciliation found and corrected a discrepancy

Payloads contain the same objects as the API reference – Transactful records with Shopify GID references, never embedded Shopify resources, and no personal contact fields unless the endpoint was registered with the read_applications scope.

Verifying deliveries

Every delivery is signed: X-Transactful-Signature is an HMAC-SHA256 of the raw body using your endpoint’s secret (shown once at creation). Reject anything that doesn’t verify.

expected = OpenSSL::HMAC.hexdigest("SHA256", secret, request.raw_post)
ok = ActiveSupport::SecurityUtils.secure_compare(expected, request.headers["X-Transactful-Signature"])

Delivery semantics

At-least-once, with retries over 24 h (backoff: 1 m, 5 m, 30 m, 2 h, 6 h, then hourly). Deduplicate on the event_id field. Endpoints failing for 7 consecutive days are disabled and you’re emailed. Events are also visible in Settings → API → Event log for 30 days regardless of delivery.