33 webhook topics, signed payloads.
Every event in Karum lands on your server instantly. HMAC-SHA256 signature, replay protection, exponential retry, dead-letter queue — enterprise-grade reliability.
POST /your-endpoint HTTP/1.1
Content-Type: application/json
X-Karum-Topic: order.placed
X-Karum-Delivery-Id: dlv_01H9X2K...
X-Karum-Signature: t=1716843201,v1=a4b3c92e...
{
"topic": "order.placed",
"deliveryId": "dlv_01H9X2K...",
"tenantId": "ten_main",
"occurredAt": "2026-05-28T09:14:02Z",
"data": {
"orderId": "ord_3Axx",
"total": 1249.90,
"currency": "TRY",
"customerId": "cus_Qh8"
}
}10 categories, 33 event types.
Orders, payments, products, vendors, payouts, security — fine-grained topics for every domain. Subscribe only to what you want to hear.
Order lifecycle
order.placedorder.cancelledPayments & refunds
payment.capturedpayment.refundedProduct catalog
product.createdproduct.updatedproduct.publishedproduct.archivedB2B approval flow
approval.request.createdapproval.approvedapproval.rejectedapproval.expiredQuote management
quote.sentquote.acceptedquote.rejectedquote.convertedquote.expiredVendor / seller
vendor.appliedvendor.approvedvendor.rejectedvendor.suspendedVendor payouts
payout.calculatedpayout.paidpayout.failedpayout.retry.scheduledpayout.retry.given_upBuybox
buybox.winner_changedReports
saved_report.dueSecurity & compliance
impersonation.startedimpersonation.endedstaff.invitedstaff.acceptedconsent.iys.push_dueEvery payload signed, replay-proof.
We sign every request, attach a timestamp, and use an idempotency-key to drive double-processing risk to zero. Failed deliveries land in the dead-letter queue and you can replay them from the panel.
HMAC-SHA256 signature
Every request carries an `X-Karum-Signature: t=<unix>,v1=<hex>` header; we sign `t.payload` concatenated.
Timestamp tolerance
Reject requests older than 5 minutes — blocks replay attacks. Tolerance is configurable.
Idempotent delivery
Every event carries a unique `deliveryId`. If it arrives twice, same result — no double-processing risk.
Dead-letter queue
After 5 failed attempts it falls into the DLQ; replay it from the panel or CLI any time.
import crypto from "node:crypto"
export function verifyKarumSignature(
payload: string,
header: string,
secret: string,
): boolean {
const parts = Object.fromEntries(
header.split(",").map((p) => p.split("=") as [string, string]),
)
const timestamp = parts.t
const signature = parts.v1
const expected = crypto
.createHmac("sha256", secret)
.update(`${timestamp}.${payload}`)
.digest("hex")
return crypto.timingSafeEqual(
Buffer.from(expected),
Buffer.from(signature),
)
}Failed deliveries with exponential backoff.
If your server doesn't return 2xx, we retry 6 times with exponential delays. After the 5th failure it lands in the dead-letter queue, replayable from the panel.
Your first sale this week. Setup in 5 minutes.
Our onboarding team runs the process. Data migration, product mapping, and channel connection included — first sale on average in 3–7 days.