API and postbacks

What this is

The REST API lets any custom store or server send order, lead, offline conversion, and refund events straight to the platform. Outbound webhooks let the platform notify your systems of events using a signed payload.

Why it matters

Use this when a supported connector (WooCommerce, Wix, or CubeCart) does not fit your setup, or when you need finer control over event delivery from a custom server.

How to do it

1. In Integration Center, open the API credentials tab and create a scoped credential for your program, choosing whether it is test mode.
2. Send events to POST /api/public/v1/events with an Authorization: Bearer YOUR_CREDENTIAL_SECRET header, a Content-Type: application/json header, and a unique Idempotency-Key header for every request; a duplicate key returns 200 without creating another conversion or commission.
3. Use one of the accepted event types: order.created, order.paid, order.completed, order.refunded, order.partially_refunded, order.cancelled, chargeback.created, chargeback.reversed, lead.submitted, lead.accepted, or offline.conversion.
4. Test credentials must send test_mode: true; live credentials must send test_mode: false.
5. To receive outbound webhooks, open the Outbound webhooks tab, create an endpoint with a URL and the event types you want, and copy the signing secret shown once. Verify the X-DA-Signature header as HMAC-SHA256 over the raw JSON body using that secret.

What happens next

Response code 202 means the event was accepted; 200 means it was already received. A 400 means an invalid payload or missing idempotency header, 401 means the credential is missing or revoked, 403 means a mismatch of mode, program, or scope, and 422 means an unsupported event type or data.

Common mistakes

Do not reuse an idempotency key across genuinely different events, and do not skip signature verification on inbound webhooks you receive from the platform.

See Developer Center for the same reference material inside the app.