Webhooks

Yalidine sends a GET request with ?subscribe=…&crc_token= to validate the endpoint at creation, edit, and periodically. The endpoint echoes the crc_token as plain text. If this fails, Yalidine disables the webhook automatically.

Receives webhook event batches from Yalidine (one event type per delivery, several events per batch; each event_id is its own idempotency key). The events are stored in the inbox and the request is answered at once — processing follows, so Yalidine's 10-second limit is always met — and an event that fails processing is retried with backoff.

Which company: the one whose webhook secret verifies X-Yalidine-Signature (HMAC-SHA256 of the raw body, hex), so several Yalidine companies never mix. A delivery no secret verifies is refused with 401 — unless the store has a single Yalidine company and it has no secret set (accepted, with a warning).

Payload: { type: "parcel_created" | "parcel_edited" | "parcel_deleted" | "parcel_status_updated" | "parcel_payment_updated", events: [{ event_id, occurred_at, data }] }. Status updates and deletions move the shipment; payment updates are kept for settlement; the rest is ignored. An unreadable body is refused with 400.

Receives webhook events from ZR Express via Svix; svix-id is the idempotency key. The event is stored in the inbox and the request answered at once; processing follows, with retries.

Which company: the one whose whsec_ secret verifies the Svix signature over the raw bytes; none verifying is a 401 — unless the store has a single ZR company and it has no secret set.

Payload: { eventType: "parcel.state.updated" | "parcel.state.situation.created" | "parcel.isReturn.updated", occurredAt, data: ParcelWebhookDto }.

Receives the updates of the merchant's own Telegram bot (the Telegram App), sent by Telegram to the URL the store gave it with setWebhook, for messages and chat membership only.

Which bot: the Telegram Consumer named in the path, whose secret must be in X-Telegram-Bot-Api-Secret-Token — checked before the body is read. Without it the update is refused with 401 and changes nothing.

What it does: /start <code> in a private chat connects that chat when the code is the bot's open pairing code, unexpired and unused, and the answer asks Telegram to send the bot's reply ({ method: "sendMessage", chat_id, text }); the connected chat blocking the bot stops its Consumer (bot_blocked), unblocking it starts it again. Anything else is acknowledged and ignored. A body that is not JSON is refused with 400.