Listing sold

We send this to your URL, once we’ve set a webhook up for your key: contact us with its name and your URL, and we give you a signing secret once. Setup, checking the signature and retries: Webhooks. Someone bought one of your listings, wherever you listed the card. It doesn’t say who bought it. Every webhook on the account gets it.

order is the same object List orders returns for a sale, with type: "listing_sale".

WEBHOOK listing.sold

Example

{
  "id": "evt_6b1d3f0c9a7e4d218c5fb0a4e2d17c36",
  "type": "listing.sold",
  "created_at": "2026-11-01T18:04:11.312Z",
  "data": {
    "order": {
      "checkout_id": "a0c3e7d1-…",
      "order_id": null,
      "type": "listing_sale",
      "status": "completed",
      "created_at": "2026-11-01T18:04:11.312+00:00",
      "completed_at": "2026-11-01T18:04:11.312+00:00",
      "amount": 45,
      "fee": 1,
      "balance_change": 44,
      "reconciled": false,
      "pack_type": null,
      "quantity": null,
      "pull_ids": [],
      "card_id": "0e94dc61-…",
      "listing_id": "5f1c2a90-…",
      "transaction_id": "a0c3e7d1-…"
    }
  }
}

Headers

X-CatchBack-Signature · string · required

t=<unix seconds>,v1=<hex>. v1 is the HMAC-SHA256 of <t>.<raw request body>, keyed with your whole secret, whsec_ included. Compute it over the raw bytes before any JSON parsing, compare in constant time, and refuse a t more than 5 minutes from your clock.

X-CatchBack-Event · string · required

The event's type.

X-CatchBack-Event-Id · string · required

The event's id, which stays the same on every retry.

X-CatchBack-Attempt · integer · required

Which try this is, from 1 to 8.

Required range: 1 <= x <= 8

Body

application/json

id · string · required

The event's id, evt_ and 32 hex characters. It never changes, including across retries, so dedupe on it.

type · string · required

More event types will be added without notice, so ignore a type you don't recognize.

Allowed value: "listing.sold"

created_at · string<date-time> · required

When the thing happened, not when we sent the event.

data · object · required

Show child attributes

Response

200

Answer any 2xx within 5 seconds, and do slow work after you've answered. Anything else counts as a failure, including a redirect. We retry after 1 minute, 5 minutes, 30 minutes, 2, 6, 12 and 24 hours, then stop at 8 attempts. Delivery is at-least-once and unordered, so dedupe on id.