Webhooks overview

Open Settings → Integrations → Webhooks in the dashboard. Add an endpoint URL + the event types you want. The same set of events fires for every restaurant; filter on your side if you only care about some.

Every event has the same envelope:

{
  "id": "evt_2025_05_28_abc123",
  "type": "order.status_changed",
  "createdAt": "2026-05-28T14:32:11Z",
  "tenantId": "luigi-pizza",
  "data": { /* event-specific payload */ }
}

id is stable per event — use it to dedupe replays.

Restora 360 signs every event with HMAC-SHA256 using your endpoint's signing secret (generated when you create the webhook). Verify before processing:

import crypto from 'crypto';

function verify(secret: string, payload: string, signature: string) {
  const expected = crypto.createHmac('sha256', secret)
    .update(payload).digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expected, 'hex'),
  );
}

The signature is sent as the X-Restora 360-Signature header.

If your endpoint returns anything outside 2xx, Restora 360 retries with exponential backoff:

• Attempt 2: +30 seconds
• Attempt 3: +5 minutes
• Attempt 4: +1 hour
• Attempts 5–10: +6 hours each

After 10 failed attempts the event is marked failed (visible in the webhooks dashboard) and stops retrying. Failed events can be manually re-sent from the dashboard.

Currently supported:

• order.created — new order placed
• order.status_changed — order moved between states
• order.canceled — customer or restaurant cancelled
• payment.succeeded — Stripe confirmed payment
• payment.failed — payment attempt failed
• payment.refunded — refund issued
• escrow.released — payout scheduled after fulfillment
• reservation.created — new booking
• reservation.confirmed — restaurant confirmed
• gift_card.redeemed — gift card applied to an order
• commission.recorded — partner commission accrued