Skip to content
platform
EN PT

Webhooks and events · Asynchronous webhook

Orders webhook

When it fires

After the order is generated on the platform, CWS Platform sends the notification to your store's endpoint. Order generation does not depend on your system's response: the webhook exists so the ERP can process the order at its own pace.

In the simplified version the payload carries the order identification and the status. The full content is fetched from the API, with the id received.

Example payload

Example from the public collection. The URL is your system's: the address below is only illustrative.

POST https://api.exemplo-cliente.com.br/webhook/pedido
Content-Type: application/json

{
    "approvalWorkflow": false,
    "dateCreated": "2025-04-23T12:17:24Z",
    "id": 1503066,
    "lastUpdated": "2025-04-23T12:18:01Z",
    "orderId": 1457551,
    "partnerCompanyName": "Nome da Loja Exemplo",
    "partnerDocument": "61.234.985/0222-64",
    "status": "AWAITING_PAYMENT",
    "workflowIsApproved": false
}

How to respond

This is asynchronous communication: the platform sends the notification and does not wait for a response to continue its processes.

Use the payload id to fetch the order details and, from there, report progress through the API: status, invoice and item tracking.

The collection does not publish a retry policy for this webhook. A safe design combines the webhook with periodic polling of the order listing by update date, which recovers whatever your endpoint did not receive.

What the collection documents

This is an example payload for the Orders Webhook in the simplified version. Your store receives this notification and can use the id to fetch the full details from the CWS API.

Authentication of your endpoint

Authentication Overview

So that CWS can send Webhook notifications (Orders and Customers) securely, our system will first authenticate with yours to obtain an access token.

You must provide us with the details of your authentication endpoint so that we can configure it.

Token Endpoint Structure (Your Responsibility)

You will need to build a POST endpoint (e.g., /token) that, upon receiving the correct credentials, returns an access token. The response must follow the OAuth2 standard:

{
    "access_token": "SEU_TOKEN_GERADO",
    "expires_in": 3600
}

Below are three real examples of how your token endpoint can be configured.

Example 1: client_credentials Flow with Basic Auth

How it works: Your credentials (clientId and clientSecret) are combined, Base64-encoded and sent in the Authorization header.

Request that CWS will make to your token endpoint:

curl --location 'https://api.cliente.com.br/oauth/access-token' \
--header 'Authorization: Basic [SUAS_CREDENCIAS_EM_BASE64]' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials'

Example 2: Flow with clientId and clientSecret in the Body

How it works: Your credentials are sent directly in the request body in JSON format.

Request that CWS will make to your token endpoint:

curl --location 'https://api.cliente.com.br/v1/token' \
--header 'User-Agent: CWS Digital' \
--header 'Content-Type: application/json' \
--data '{
    "clientId": "SEU_CLIENT_ID",
    "clientSecret": "SEU_CLIENT_SECRET"
}'

Example 3: Flow with Credentials in Custom Headers

How it works: A non-standard model where the username and password are sent in specific headers, instead of using Authorization or the request body.

Request that CWS will make to your token endpoint:

curl --location --request POST 'https://api.cliente.com.br/rest/api/oauth2/v1/token?grant_type=password' \
--header 'username: SEU_USUARIO' \
--header 'password: SUA_SENHA'

Related endpoints

Webhooks and events

Generated from the public API collection, published on 2026-09-04: api-docs.cws.digital.