Security

Authentication

All API requests require the following headers:

Decryption of EncryptedVirtualCollections

The EncryptedVirtualCollections field can be decrypted using the following specifications:

Steps:

  1. Base64 decode the encrypted string
  2. Initialize AES CBC with key and IV
  3. Decrypt and convert result to UTF-8 string

Webhook Documentation

Sell Review Request Created

This webhook is triggered when a buyer submits a sell review request for an order.

Payload:

{
  "source": "Marketplace",
  "sourceOrderNumber": "ORD-458236",
  "requestDescription": "The product was not as described."
}

Fields:

Support Ticket Updated

Triggered when a ticket is updated, including replies, mediation, or status changes.

Payload:

{
  "supportTicketId": "b3f32b90-89b1-4636-85d0-e5f9a12e06b4",
  "underMediationChanged": true,
  "closed": false,
  "newReply": {
    "replyId": "693eb7a2-07b9-4ab4-afe0-2b07a2c5d841",
    "createAt": "2025-07-20T15:04:12Z",
    "text": "Can you provide more details about the issue?",
    "replier": "Mediation",
    "attachmentUrls": ["https://cdn.example.com/replies/abc123.jpg"]
  }
}

Order Invoice Status Changed

Triggered when the overall status of an order invoice changes.

{
  "orderId": "b3c09d58-6ac6-4b20-9286-601c1d62f4e2",
  "status": 1,
  "price": 47.99
}

Product Status Changed

Triggered when a product's availability or price changes.

{
  "id": "fa29855a-5d0e-4e2e-b7c7-120cb98c19fb",
  "price": 39.99,
  "status": 1
}

Inventory Item Delivered

Triggered when an item is delivered from personal inventory.

{
  "takeoutInventoryId": "21f2d0c8-7a4d-4ea9-bd7c-34df10b38d1a",
  "inventoryId": "9a4b7b3e-6f5c-4d94-a087-d11e6c8754f7",
  "entryPrice": 25.50,
  "encryptedVirtualCollections": "dZ5xmvUJ1k4YB4C...",
  "deliveryKey": "TKO-20250720-ABCD1234",
  "productId": "e69a7f45-6e39-4e12-8ad6-dad09397d72d"
}

Inventory Item Refunded

Triggered when a delivered inventory item is refunded.

{
  "inventoryId": "f71c2b48-82b9-48de-9a94-3db452cd1733"
}

❌ Deprecated Webhooks

DEPOSIT_STATUS_CHANGED
Formerly used to report wallet deposit events.
Status: Deprecated – no longer in use.