Loading…
Loading…
Chat with Kora™
Online
Powered by Kora™ — responses may not be 100% accurate
35
Total Endpoints
11
API Categories
7
Webhook Events
REST
JSON over HTTPS
Authenticated endpoints require a valid NextAuth session cookie. For programmatic access, use the session JWT in the Authorization: Bearer <token> header. Public endpoints under /api/public/* require no authentication.
API requests are rate-limited per IP and per user session. Standard limits are 100 requests per minute for authenticated endpoints and 30 per minute for public endpoints. Rate limit headers are included in every response: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset.
Create, read, update, and manage print jobs.
Manage customer records and contacts.
Invoice management, payments, and financial operations.
Public quote calculation endpoints for instant pricing.
Public endpoints for customer-facing portal. Authenticated by portal slug, no API key required.
Manage outbound webhook subscriptions for real-time event notifications.
Search supplier catalogs, check inventory, and get pricing from S&S Activewear, SanMar, and more.
Job scheduling, Kalendar views, and production queue.
Business analytics, revenue tracking, and KPIs.
Shop settings, user management, and system configuration.
Rate shopping, label generation, and shipment tracking.
7 event types with real-time delivery
Kontraktr™ delivers webhook events to your registered endpoints in real time. Each event includes a JSON payload with the event type, timestamp, and relevant data. Events are signed with HMAC-SHA256 for verification.
HMAC-SHA256 signature verification
whsec_...) is returned once. Store it securely.X-Webhook-Signature, X-Webhook-Timestamp, and X-Webhook-Id.sha256=HMAC(timestamp.body, secret).| Header | Description |
|---|---|
X-Webhook-Signature | HMAC-SHA256 hex digest prefixed with sha256= |
X-Webhook-Timestamp | Unix timestamp (seconds) of when the event was dispatched |
X-Webhook-Id | Unique delivery UUID for idempotency checks |
Content-Type | Always application/json |
import crypto from "crypto";
function verifyWebhookSignature(
body: string,
signature: string,
timestamp: string,
secret: string
): boolean {
const payload = `${timestamp}.${body}`;
const expected = crypto
.createHmac("sha256", secret)
.update(payload)
.digest("hex");
return crypto.timingSafeEqual(
Buffer.from(`sha256=${expected}`),
Buffer.from(signature)
);
}
// In your Express/Next.js handler:
app.post("/webhook", (req, res) => {
const sig = req.headers["x-webhook-signature"];
const ts = req.headers["x-webhook-timestamp"];
const valid = verifyWebhookSignature(
JSON.stringify(req.body), sig, ts, process.env.WEBHOOK_SECRET
);
if (!valid) return res.status(401).send("Invalid signature");
// Process event...
res.status(200).send("OK");
});Kontraktr™ retries failed webhook deliveries with exponential backoff:
| Attempt | Delay | Notes |
|---|---|---|
| 1 | Immediate | Initial delivery |
| 2 | 30 seconds | First retry |
| 3 | 5 minutes | Second retry |
| 4 | 30 minutes | Third retry |
| 5 | 2 hours | Final retry |
A delivery is considered failed if your endpoint returns a non-2xx status code or times out after 10 seconds. After 5 failed attempts, the endpoint is automatically disabled. You can re-enable it from Settings → Webhooks.
Use the X-Webhook-Id header for idempotency to safely handle duplicate deliveries.
200 OK within 10 seconds to avoid retriesX-Webhook-Id header for idempotency