Order completed

We send this to your URL, once we’ve set a webhook up for your key: contact us with its name and your URL, and we give you a signing secret once. Setup, checking the signature and retries: Webhooks. A pack order, card order or sell-back made through the API finished. It includes an order we closed from our records after you lost its response. App activity sends nothing, and an order held for review sends no event. Every webhook on the account gets it.

order is the same object List orders returns for it. Get an order has its pulls or card.

WEBHOOK order.completed

Example

{
  "id": "evt_0b7e4d21c8f53a96e1d07c4f2ab86d13",
  "type": "order.completed",
  "created_at": "2026-11-01T18:04:11.312Z",
  "data": {
    "order": {
      "checkout_id": "3e1ab17c-…",
      "order_id": "order-1042",
      "type": "pack_purchase",
      "status": "completed",
      "created_at": "2026-11-01T18:04:10.102+00:00",
      "completed_at": "2026-11-01T18:04:11.312+00:00",
      "amount": 25,
      "fee": 0,
      "balance_change": -25,
      "reconciled": false,
      "pack_type": "bronze",
      "quantity": 1,
      "pull_ids": [
        "e9d27918-…"
      ],
      "card_id": null,
      "listing_id": null,
      "transaction_id": null
    }
  }
}

Headers

X-CatchBack-Signature · string · required

t=<unix seconds>,v1=<hex>. v1 is the HMAC-SHA256 of <t>.<raw request body>, keyed with your whole secret, whsec_ included. Compute it over the raw bytes before any JSON parsing, compare in constant time, and refuse a t more than 5 minutes from your clock.

X-CatchBack-Event · string · required

The event's type.

X-CatchBack-Event-Id · string · required

The event's id, which stays the same on every retry.

X-CatchBack-Attempt · integer · required

Which try this is, from 1 to 8.

Required range: 1 <= x <= 8

Body

application/json

id · string · required

The event's id, evt_ and 32 hex characters. It never changes, including across retries, so dedupe on it.

type · string · required

More event types will be added without notice, so ignore a type you don't recognize.

Allowed value: "order.completed"

created_at · string<date-time> · required

When the thing happened, not when we sent the event.

data · object · required

Show child attributes

Response

200

Answer any 2xx within 5 seconds, and do slow work after you've answered. Anything else counts as a failure, including a redirect. We retry after 1 minute, 5 minutes, 30 minutes, 2, 6, 12 and 24 hours, then stop at 8 attempts. Delivery is at-least-once and unordered, so dedupe on id.