Skip to main content

17TRACK Webhook (TRACKING_UPDATED)

POST 
/webhooks/seventeentrack/:webhook_token

This endpoint is INCOMING — it is called by 17TRACK, not by SKU.io clients. Documented here for reference only.

Full URL shape: POST /webhooks/seventeentrack/{webhook_token}. The token in the URL identifies the tenant + instance; the sign field at the top of the JSON body is an HMAC-SHA256 over the request body computed with the instance's API key as the HMAC secret — verified by VerifySeventeenTrackWebhook middleware before the controller runs.

Envelope (v2.4):

{
  "event": "TRACKING_UPDATED" | "TRACKING_STOPPED",
  "data": { ... carrier-event payload ... },
  "sign": "<sha256-hex>"
}

Behavior:

  • Empty body → 200 { status: 'acknowledged' } (avoids 17TRACK retry storm).
  • Missing event key → 200 { status: 'ignored' }.
  • Valid payload → 200 { status: 'success' } and a background job is dispatched for async ingest. Out-of-order events (older last_event_at than what's already stored) are dropped inside the repository.

Why always 200? 17TRACK retries non-2xx responses for several hours. Any non-actionable scenario still acks with 200 to avoid bogus retry storms.

Request​

Responses​

OK

Response Headers
    Content-Type