Skip to main content
WEBHOOK
orderPaid
{
  "type": "order.paid",
  "eventId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "timestamp": "2023-11-07T05:31:56Z",
  "apiVersion": "2026-05-12",
  "data": {
    "orderId": "<string>",
    "storefrontId": "<string>",
    "merchantUid": "<string>",
    "paidAt": "2023-11-07T05:31:56Z",
    "totalAmount": 123,
    "currency": "<string>"
  }
}

Authorizations

​
Authorization
string
header
required

Marea API key. mk_dev_* keys are developer-scoped (bootstrap, list users, register webhook). mk_user_* keys are user-scoped (manage that one user's storefronts/products). Scopes: catalog:read, catalog:write, storefront:publish, me:verify, me:resendVerification, developer:bootstrap, developer:read, developer:issueUserKey, developer:webhooks.

Headers

​
X-Marea-Signature
string
required

HMAC-SHA256 signature, t=<unix-ts>,v1=<hex>. Verify before processing.

Example:

"t=1714867260,v1=5f9b...e3a1"

​
X-Marea-Event-Type
enum<string>
required

Event type identifier (mirrors type in the body). Enum of webhook event types a WebhookEndpoint may subscribe to. Developer-scope endpoints can subscribe to any value; merchant-scope endpoints are restricted to order.* (PRD-14).

Available options:
user.verified,
user.cancelled,
order.created,
order.status_updated,
order.paid
​
X-Marea-Endpoint-Id
string
required

The endpointId that owns this delivery.

Example:

"mk_we_0123456789abcdef"

​
X-Marea-Signing-Version
integer
required

Signing-secret version used to compute X-Marea-Signature (matches the endpoint's signingSecretVersion at dispatch time).

Required range: x >= 1
Example:

1

​
X-Marea-Source
enum<string>
required

Scope of the endpoint that received the event.

Available options:
developer,
merchant
​
X-Marea-Event-Id
string<uuid>
required

UUID v4 — receivers should use this for idempotent processing.

​
X-Marea-Delivery-Id
string
required

Per-attempt delivery id. Different from X-Marea-Event-Id on retries of the same event.

​
User-Agent
string
required

Always marea-webhook/1.0.

Example:

"marea-webhook/1.0"

Body

application/json

Webhook envelope dispatched for order.paid events.

​
type
enum<string>
required
Available options:
order.paid
Example:

"order.paid"

​
eventId
string<uuid>
required

UUID v4. Use for receiver-side idempotency.

​
timestamp
string<date-time>
required

ISO-8601 timestamp the event was emitted.

​
apiVersion
enum<string>
required

Webhook envelope/version contract identifier.

Available options:
2026-05-12
Example:

"2026-05-12"

​
data
object
required

Response

Receiver accepted the event. Any 2xx terminates the retry loop.