Events & payloads

Receiving an event needs the scope for its data

Creating a subscription needs write_webhooks. Receiving an event needs the read scope of the data it carries, checked on every delivery against what your installation holds at that moment:

Event family	Scope needed to receive
order.*	read_orders (write_orders includes it)
product.*	read_products
customer.*	read_customers
form.submitted	read_forms

Fields marked personal data below are removed from the body unless your installation also holds read_customer_pii. If the merchant withdraws a scope, the next event is not delivered to you. Subscribing to an event you cannot receive is refused with 400, naming the scope you need.

The catalogue

Event	Subscribable	Sent today
order.paid	yes	yes
order.shipped	yes	yes
order.cancelled	yes	yes
order.refunded	yes	yes
order.created	yes	no — accepted in a subscription, never emitted yet
order.fulfilled	yes	no
product.created / product.updated / product.deleted	yes	no
customer.created / customer.updated	yes	no
form.submitted	yes	yes

Build only on the events marked yes. The others are reserved names: you can subscribe to them now, and you will start receiving them when the platform begins emitting them — but do not wait on them for anything today.

Body

There is no envelope: the body is the event object, camelCase JSON. The event type travels in the Ciqra-Event header and the event id in Ciqra-Event-Id.

order.*

{
  "orderId": "5b1e…",
  "orderNumber": "SEY-100482",
  "status": "Paid",
  "customerEmail": "shopper@example.com",
  "occurredAt": "2026-09-22T10:15:03.412+00:00"
}

Field	Notes
orderId	UUID.
orderNumber	The number the merchant and shopper see.
status	The status the order moved to: Paid, Shipped, Cancelled or Refunded.
customerEmail	Personal data — present only with read_customer_pii.
occurredAt	When the transition was recorded.

The event id is {orderId}:{status}, so one order produces at most one event per status.

The body is deliberately minimal. For line items, totals or addresses you will need the order API, which is not yet open to apps — see limitations.

form.submitted

{
  "formId": "…",
  "formName": "Contact",
  "submissionId": "…",
  "languageCode": "tr",
  "submittedAt": "2026-09-22T10:15:03+00:00",
  "values": { "name": "…", "email": "…", "message": "…" }
}

Field	Notes
values	Personal data — present only with read_customer_pii. Keyed by the form’s own field keys, which the merchant defines; it holds whatever the shopper typed.

With read_forms alone you learn that a form was submitted, which one, when and in which language.