Event subscription deleted
Fires when an event subscription is deleted. The data is the subscription as it was. The body is an event object with the event subscription in data.
X-Comecero-Signature?stringProof the delivery comes from Comecero and was not changed. It is the HMAC-SHA256 of the raw request body (UTF-8), keyed with the signature key as UTF-8, written as 64 lowercase hex characters. The key is the event subscription's signature_key, or the account's signature key (Settings, Technical) when the subscription has none. Every account gets one when it is created, so deliveries are signed unless the key was removed. To check it, compute the HMAC over the body exactly as received, before you parse it, and compare the two strings in constant time. Reject the delivery when they differ. The signature has no timestamp, so to guard against a replayed delivery also skip any event_id you already handled. If you cannot check signatures, use the event only as a hint: get the object by its id from the API before you act on it.
^[0-9a-f]{64}$User-Agent?stringAlways Comecero-Event (+https://comecero.com).
The event, sent by POST to your event subscription's destination as JSON (Content-Type: application/json), XML or an HTML table, following its format.
application/json- body
One delivery of one event to one event subscription. When something happens (an order is created, a payment completes), Comecero makes one event for each active event subscription to that event type, each with its own event_id and the same fingerprint. This is also the body Comecero POSTs to your webhook URL.
object?"event"Always event.
"event"type?event_typeThe kind of event. See the Webhooks section of this reference for when each one fires and what its data holds.
"account:modified""cart:payment_completed""gateway:created""gateway:modified""event_subscription:created""event_subscription:modified""event_subscription:deleted""license_service:low_licenses""invoice:created""invoice:published""invoice:paid""invoice:payment_completed""order:created""order:payment_completed""order:fulfilled""order:licenses_assigned""payment:completed""payment:created_success""payment:created_failure""payment:captured_success""payment:captured_failure""payment:voided""product:created""product:modified""product:deleted""product:low_inventory""refund:created_success""refund:created_failure""refund:deleted""user:created""user:modified""shipment:created""shipment:modified""shipment:deleted""subscription:created""subscription:modified""subscription:cancelled""subscription:cancellation_scheduled""subscription:cancellation_unscheduled""subscription:completed""subscription:converted""subscription_item:added""subscription_item:cancelled""subscription_item:cancellation_scheduled""subscription_item:cancellation_unscheduled""subscription_item:modified""subscription:renewal_success""subscription:renewal_failure"event_subscription?|The event subscription this delivery is for: its URL, or the full object when you send expand=event_subscription. Left out when the token may not read event subscriptions.
environment_variables?|The name and value pairs set on the event subscription when the event was made, passed through so your endpoint can read its own settings.
data?The event subscription the event is about, shaped like a GET of it, with the event subscription's expand, show and hide applied.
Answer with any 2xx status within 60 seconds to mark the event delivered; the body is ignored. Anything else counts as a failure: another status (redirects are not followed), a timeout, or no connection. After a failure Comecero retries on a growing schedule: three times 2 minutes apart, then every 15 minutes, every hour, every 2 hours, every 4 hours and every 8 hours, 23 attempts over about 56 hours in all. Then the event is failed and is not tried again by itself; you can send it again with POST /events/{event_id}/retry while it is kept. Events are kept for 30 days after their last change, and for 7 days once delivered or in test mode. Deliveries can arrive more than once and out of order, so use event_id to skip repeats and compare date_created or get the object fresh before you overwrite newer data. Each event subscription gets its own copy: the same occurrence shares one fingerprint across subscriptions.
{ "object": "event", "url": "https://api.comecero.com/api/v1/events/1102611073847EVt7Kq2Za", "event_id": "1102611073847EVt7Kq2Za", "test": true, "account_id": "AB1234", "type": "event_subscription:deleted", "event_subscription": "https://api.comecero.com/api/v1/event_subscriptions/1102610913420ES4f9QmLp", "fingerprint": "k2P9wQ7xR4vT1nY8", "status": "delivered", "date_created": "2026-11-07T14:32:10Z", "date_modified": "2026-11-07T14:32:11Z", "environment_variables": { "store": "main" }, "data": { "object": "event_subscription", "url": "https://api.comecero.com/api/v1/event_subscriptions/1102610913420ES4f9QmLp", "event_subscription_id": "1102610913420ES4f9QmLp", "date_created": "2026-11-07T14:20:03Z", "date_modified": "2026-11-07T14:20:03Z", "test": true, "active": true, "account_id": "AB1234", "event_type": "order:created", "destination": "https://example.com/webhooks/comecero", "format": "json", "method": "http", "timezone": null, "signature_key": null, "expand": "customer", "show": null, "hide": null, "http_authorization_username": null, "http_authorization_password": null, "custom_header_name": null, "custom_header_value": null, "environment_variables": { "store": "main" }, "comments": "Order sync" }}{}Event subscription modified Webhook
Fires when an event subscription is changed. The `data` includes its `signature_key` and HTTP authorization password, so treat this event as secret. The body is an event object with the event subscription in `data`.
License service low on licenses Webhook
Fires when a license key is taken from a list-based license service and the number left is at or below its `notify_at_count`, or the list is empty. The keys themselves are not sent: `list.licenses` holds a note instead. New accounts get an email subscription to this event by default. The body is an event object with the license service in `data`.