Webhooks and push

How signing works

Every push into Ateliq, and every webhook Ateliq sends you, is signed the same way with a shared secret. Ateliq shows the secret once when you create the source or destination; you can rotate it.

X-Retail-Timestamp: <unix time in whole seconds>
X-Retail-Signature: sha256=<hex HMAC-SHA256 of "<timestamp>." followed by the raw body>

To check a webhook from Ateliq, compute the HMAC-SHA256 of the timestamp, a full stop and the raw request body with your secret, compare it with the signature in constant time, and refuse timestamps more than five minutes from your clock. Ateliq refuses pushes whose timestamp is more than five minutes off, and ignores a request it has already seen.

Into Ateliq

Push catalogue records

Create a source of kind Your system sends data in Integrations. Ateliq shows its address and signing secret.

POST /api/retail/push/<source id>
{
  "full": false,
  "records": [
    { "sku": "KRT-0142", "name": "Ivory chikankari kurta", "category": "fashion",
      "type": "kurta", "audience": "women", "sizes": ["S", "M", "L"],
      "listPrice": 4800, "currency": "INR", "status": "active",
      "stock":  [ { "location": "BLR-01", "size": "M", "qty": 3 } ],
      "prices": [ { "location": "BLR-01", "price": 4600, "currency": "INR" } ] }
  ]
}

• Each record needs a sku. Other fields are optional: name, brand, category, type, colour, metal, audience, sizes, tags, images, listPrice, currency, status, stock and prices (by your location codes, mapped to stores in the source).
• Up to 10,000 records and 5 MB per push.
• "full": true says this push is your whole catalogue; products not in it are hidden (never deleted), with the same safeguard as other sources. See Catalogue sources.

Sales and returns from your ERP

POST /api/retail/push/<source id>/sales

Send sales (with the hand-off code when the shopper showed one, your order reference, the time and the products) and returns (order reference, product, quantity and time), up to 1,000 rows a push. Ateliq joins them to hand-offs to show what was kept and what came back.

Door counts

POST /api/retail/push/<source id>/footfall

Send store, date and count. Good rows are saved and refused rows are listed in the reply. You can also upload door counts as a CSV in Insights.

From your e-commerce platform and payment provider

• Shopify and WooCommerce product and stock changes arrive as those platforms' own signed webhooks, once you turn on live updates. See Catalogue sources.
• Razorpay and Stripe confirm payments and refunds with their own signed webhooks. See Payments and messages.

Out of Ateliq

Add destinations in Integrations (up to ten). Each sends only to a secure (https) address on the public internet, has its own secret, and has a ping test.

Your CRM

CRM events: visit, tried, bought, hand-off paid, appointment booked, look saved, and size watch.

Only shoppers whose opt-in text you marked as covering customer systems are sent. When a shopper is deleted in Ateliq, they are erased at the destination too.

Lost demand to your planning system

The planner webhook sends what shoppers asked for and didn't find, as a signed document:

{ "object": "lost_demand", "from": "…", "to": "…", "generatedAt": "…", "rows": [ … ] }

Choose a 7 or 28 day window, and send it only when you press Send now, or every day. A planning-system format with one demand line per store, product and size (no phrases) is also available.