Shipping-protection enablement callback

The merchant implements this webhook and configures its URL at openapiConfig.callEndpoints.openApiSpSwitchCallback.

Xcotton sends JSON over HTTP POST with the xmh-hmc-signature header. Only HTTP 200 counts as successful receipt. See authentication §4.2 for the signature rules.

For the complete schema, see API reference · webhook shippingProtectionSwitchChanged.

Caution

secret is the OpenAPI App Secret. Store it encrypted and never write it to logs, browser pages, or source control. It is not the webhook signKey.

{
  "xmhShopId": 10001,
  "xmhUid": 20001,
  "shopDomain": "shop.example.com",
  "appId": "10000001",
  "secret": "example_app_secret",
  "status": "approved"
}

status values:

• approved: shipping-protection enablement was approved.
• rejected: shipping-protection enablement was rejected.