Documentation
Webhooks
Subscribe to events with signed, idempotent delivery.
Webhooks notify your systems when returns change state or signals are captured. Delivery is HMAC-signed with retry and a dead-letter queue.
Events
- return.submitted · return.approved · return.closed
- fit.signal.captured
- instantcredit.granted · instantcredit.clawback
Verifying signatures
ts
const sig = req.headers['x-resreturn-signature'];
const expected = hmacSHA256(rawBody, process.env.RR_WEBHOOK_SECRET);
if (!timingSafeEqual(sig, expected)) return res.status(401).end();Always return 2xx quickly and process asynchronously — slow handlers trigger retries.