Configure the merchant's single shipment webhook
curl --request POST \
--url https://api-test.drop-hub.com/v2/external/webhook \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"url": "<string>",
"events": []
}
'import requests
url = "https://api-test.drop-hub.com/v2/external/webhook"
payload = {
"url": "<string>",
"events": []
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({url: '<string>', events: []})
};
fetch('https://api-test.drop-hub.com/v2/external/webhook', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-test.drop-hub.com/v2/external/webhook",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'url' => '<string>',
'events' => [
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-test.drop-hub.com/v2/external/webhook"
payload := strings.NewReader("{\n \"url\": \"<string>\",\n \"events\": []\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-test.drop-hub.com/v2/external/webhook")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"url\": \"<string>\",\n \"events\": []\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-test.drop-hub.com/v2/external/webhook")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"url\": \"<string>\",\n \"events\": []\n}"
response = http.request(request)
puts response.read_body{
"webhook": {
"endpointId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"url": "<string>",
"status": "ACTIVE",
"subscribedEventTypes": [
"shipment.created"
],
"version": 1,
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"previousSecretValidUntil": "2023-11-07T05:31:56Z"
}
}{
"type": "https://api.drop-hub.com/problems/authentication-required",
"title": "Authentication required",
"status": 401,
"detail": "Authentication is required for this resource.",
"instance": "/v2/external/shipments/018f2d8a-1f00-7000-8000-000000000206",
"code": "AUTHENTICATION_REQUIRED",
"timestamp": "2026-08-22T18:30:00Z",
"correlationId": "018f2d8a-1f00-7000-8000-000000000207",
"requestId": "018f2d8a-1f00-7000-8000-000000000208"
}{
"type": "https://api.drop-hub.com/problems/access-denied",
"title": "Access denied",
"status": 403,
"detail": "Access to this resource is denied.",
"instance": "/v2/external/shipments/018f2d8a-1f00-7000-8000-000000000206",
"code": "ACCESS_DENIED",
"timestamp": "2026-08-22T18:30:00Z",
"correlationId": "018f2d8a-1f00-7000-8000-000000000207",
"requestId": "018f2d8a-1f00-7000-8000-000000000208"
}{
"type": "https://api.drop-hub.com/problems/access-denied",
"title": "Access denied",
"status": 403,
"detail": "Access to this resource is denied.",
"instance": "/v2/external/shipments/018f2d8a-1f00-7000-8000-000000000206",
"code": "ACCESS_DENIED",
"timestamp": "2026-08-22T18:30:00Z",
"correlationId": "018f2d8a-1f00-7000-8000-000000000207",
"requestId": "018f2d8a-1f00-7000-8000-000000000208"
}{
"type": "https://api.drop-hub.com/problems/access-denied",
"title": "Access denied",
"status": 403,
"detail": "Access to this resource is denied.",
"instance": "/v2/external/shipments/018f2d8a-1f00-7000-8000-000000000206",
"code": "ACCESS_DENIED",
"timestamp": "2026-08-22T18:30:00Z",
"correlationId": "018f2d8a-1f00-7000-8000-000000000207",
"requestId": "018f2d8a-1f00-7000-8000-000000000208"
}{
"type": "https://api.drop-hub.com/problems/access-denied",
"title": "Access denied",
"status": 403,
"detail": "Access to this resource is denied.",
"instance": "/v2/external/shipments/018f2d8a-1f00-7000-8000-000000000206",
"code": "ACCESS_DENIED",
"timestamp": "2026-08-22T18:30:00Z",
"correlationId": "018f2d8a-1f00-7000-8000-000000000207",
"requestId": "018f2d8a-1f00-7000-8000-000000000208"
}External Webhooks
Configure the merchant's single shipment webhook
Returns the HMAC signing secret once. Events default to every partner event.
POST
/
v2
/
external
/
webhook
Configure the merchant's single shipment webhook
curl --request POST \
--url https://api-test.drop-hub.com/v2/external/webhook \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"url": "<string>",
"events": []
}
'import requests
url = "https://api-test.drop-hub.com/v2/external/webhook"
payload = {
"url": "<string>",
"events": []
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({url: '<string>', events: []})
};
fetch('https://api-test.drop-hub.com/v2/external/webhook', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-test.drop-hub.com/v2/external/webhook",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'url' => '<string>',
'events' => [
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-test.drop-hub.com/v2/external/webhook"
payload := strings.NewReader("{\n \"url\": \"<string>\",\n \"events\": []\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-test.drop-hub.com/v2/external/webhook")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"url\": \"<string>\",\n \"events\": []\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-test.drop-hub.com/v2/external/webhook")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"url\": \"<string>\",\n \"events\": []\n}"
response = http.request(request)
puts response.read_body{
"webhook": {
"endpointId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"url": "<string>",
"status": "ACTIVE",
"subscribedEventTypes": [
"shipment.created"
],
"version": 1,
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"previousSecretValidUntil": "2023-11-07T05:31:56Z"
}
}{
"type": "https://api.drop-hub.com/problems/authentication-required",
"title": "Authentication required",
"status": 401,
"detail": "Authentication is required for this resource.",
"instance": "/v2/external/shipments/018f2d8a-1f00-7000-8000-000000000206",
"code": "AUTHENTICATION_REQUIRED",
"timestamp": "2026-08-22T18:30:00Z",
"correlationId": "018f2d8a-1f00-7000-8000-000000000207",
"requestId": "018f2d8a-1f00-7000-8000-000000000208"
}{
"type": "https://api.drop-hub.com/problems/access-denied",
"title": "Access denied",
"status": 403,
"detail": "Access to this resource is denied.",
"instance": "/v2/external/shipments/018f2d8a-1f00-7000-8000-000000000206",
"code": "ACCESS_DENIED",
"timestamp": "2026-08-22T18:30:00Z",
"correlationId": "018f2d8a-1f00-7000-8000-000000000207",
"requestId": "018f2d8a-1f00-7000-8000-000000000208"
}{
"type": "https://api.drop-hub.com/problems/access-denied",
"title": "Access denied",
"status": 403,
"detail": "Access to this resource is denied.",
"instance": "/v2/external/shipments/018f2d8a-1f00-7000-8000-000000000206",
"code": "ACCESS_DENIED",
"timestamp": "2026-08-22T18:30:00Z",
"correlationId": "018f2d8a-1f00-7000-8000-000000000207",
"requestId": "018f2d8a-1f00-7000-8000-000000000208"
}{
"type": "https://api.drop-hub.com/problems/access-denied",
"title": "Access denied",
"status": 403,
"detail": "Access to this resource is denied.",
"instance": "/v2/external/shipments/018f2d8a-1f00-7000-8000-000000000206",
"code": "ACCESS_DENIED",
"timestamp": "2026-08-22T18:30:00Z",
"correlationId": "018f2d8a-1f00-7000-8000-000000000207",
"requestId": "018f2d8a-1f00-7000-8000-000000000208"
}{
"type": "https://api.drop-hub.com/problems/access-denied",
"title": "Access denied",
"status": 403,
"detail": "Access to this resource is denied.",
"instance": "/v2/external/shipments/018f2d8a-1f00-7000-8000-000000000206",
"code": "ACCESS_DENIED",
"timestamp": "2026-08-22T18:30:00Z",
"correlationId": "018f2d8a-1f00-7000-8000-000000000207",
"requestId": "018f2d8a-1f00-7000-8000-000000000208"
}Authorizations
OAuth 2.0 client-credentials flow for external machine-to-machine integrations.
Headers
Optional. Retry safety is handled for you: when this header is absent DropHub derives the key from the reference you already send — the order number on a shipment create, the shipment id on a cancel — scoped to your merchant account. Two calls naming the same order are treated as one submission and the second returns the original result. Send your own key only if you want to control the replay window yourself; an explicit key always wins.
Required string length:
16 - 128Example:
"merchant-order-20260822-0001"
Body
application/json
Response
Webhook plus the HMAC signing secret disclosed for creation or rotation.
Show child attributes
Show child attributes
⌘I
