Receive Starshipit Tracking Webhook (Signed)
POST/webhooks/starshipit/tracking
Called by Starshipit, not by an integrator. Alternative tracking-notification URL (note: no /api prefix) that identifies the connection from the signature instead of the path. No bearer token. Send it to the workspace's own host; for new setups prefer Receive Starshipit Tracking Webhook, whose URL names the connection.
Signature matching: SKU.io compares x-starshipit-signature with the HMAC-SHA256 of the raw body under every Starshipit connection's saved webhook secret and uses the connection whose secret matches. If no connection has a secret, the webhook is accepted unsigned (signature_valid: false) and attributed to the first connection. If at least one secret is saved and the signature is missing or matches none, the response is 401 (Missing signature / Invalid signature). An empty body is acknowledged and ignored.
Payload: Starshipit's tracking notification JSON. SKU.io reads order_number, tracking_number, tracking_status (e.g. Printed, Dispatched, Manifested, InTransit, OutForDelivery, Delivered, AttemptedDelivery, Exception, AwaitingCollection, Cancelled), carrier_name, carrier_service, shipment_date, last_updated_date and price_breakdown. The event is stored (see List Webhook Events) and processed in the background: it updates the cached Starshipit order and its fulfillment's tracking. Printed/Dispatched/Manifested are treated as shipped, Cancelled as cancelled, everything else as a tracking update.
Signature: Starshipit signs a webhook with the secret entered in its dashboard (Settings → Tracking & notifications) and sends the hex HMAC-SHA256 of the raw body in x-starshipit-signature. When the connection has a webhook secret saved in SKU.io, only webhooks with a matching signature are accepted; anything else returns 401. When no secret is saved, unsigned webhooks are accepted and stored with signature_valid: false.
Authentication: none (HMAC signature, see above).
Request
Responses
- 200
- 401
- 422
- 429
OK
Response Headers
Unauthorized
Response Headers
Validation failed — the body is a field → messages map (Laravel shape) or the platform envelope with a stable machine-readable code. Fix the payload and resubmit.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.