Test Your Receiver

Webhooks are delivered in the sandbox environment as well as production, so you can exercise your receiver end to end — a real signed delivery, triggered by a real order — before any of it matters.

Sandbox and production are separate subscriptions with separate secrets. Verifying in sandbox does not enable anything in production, and the sandbox secret will not verify a production delivery.

---

Set up a sandbox subscription

Subscriptions are set up by Komplett. There is no self-service registration, in sandbox or in production — each one is configured manually today.

Contact your Komplett Account Manager with the sandbox HTTPS URL you want deliveries sent to and the event types you want. You receive a subscription identifier and a signing secret for that subscription.

For the sandbox host to build your URL against, see Getting Started → Environments.

---

A real event end to end

1. We register your sandbox destination URL and the event types you asked for.
2. You store the sandbox signing secret somewhere your receiver can read it, separate from your production one.
3. You place a sandbox order through the Checkout API. See Checkout overview for the create-and-submit flow.
4. Your endpoint receives a signed orders.order.placed once the order has been confirmed in our order system. This is not immediate — it follows order confirmation, not your submit call, so allow for a delay rather than assuming the delivery failed.
5. You verify the signature and fetch resource.href to get the order itself. See Handle an order placed event for the whole path.
6. Further events follow as the order progresses — expected delivery dates, dispatch, invoicing and completion. A sandbox order that is never dispatched or invoiced will not raise the later ones, so do not read their absence as a fault. See Follow an order lifecycle.

Remember that only the SoldTo customer is notified. If the sandbox order is placed such that your account is PlacedBy but a different account is SoldTo, no delivery is sent — the receiver is not broken.

---

Before you go live

• Signature verification has been exercised by a real delivery, not only by a unit test against a hand-made payload. See Verify a signature.
• Your endpoint answers 2xx within 10 seconds, acknowledging before it does the work.
• Duplicate eventIds are ignored. Replay the same delivery twice and confirm the second one changes nothing.
• Unrecognised eventTypes are ignored rather than erroring, so new event types cannot break your receiver.
• The registered URL is final and does not redirect. A 3xx is treated as a failure — see Retries and failures.
• The production secret is stored separately from the sandbox one, and neither is in source control.