Webhooks
test_webhook_url and live_webhook_url in the reseller dashboard. Each environmentonly receives events from matching API keys.
Delivery
POST requests with Content-Type: application/json.Important: Return any 2xxstatus promptly. Failed deliveries may be retried — the same event may arrive more than once. Handle events idempotently.
Verify signatures
Important: Always verify x-ciao-signaturebefore processing a webhook. Reject requests with invalid signatures.
x-ciao-signature: <hex>HMAC-SHA256(json_encode(payload), your_api_token)payload is the decoded JSON body and your_api_token is your API secret for the matchingenvironment.
Envelope
{
"event": "subscription.cancel_requested",
"data": { },
"created_at": "2026-07-10T14:00:01.000000Z"
}subscription.cancel_requested
Important: Stop billing immediately, then call Confirm cancellation. The partner is not canceled until you confirm.
{
"event": "subscription.cancel_requested",
"data": {
"access_code": "AbC123XyZ456789",
"reseller_subscription_reference": "sub-order-4421"
},
"created_at": "2026-07-10T14:00:01.000000Z"
}| Field | Description |
|---|---|
access_code | Pass to Confirm cancellation |
reseller_subscription_reference | Your recurring-order ID, if stored on first cycle; omitted if never set |
What to do
1.
2.
access_code andreseller_subscription_reference.3.
subscription.cancelled after you confirm.subscription.
Modified at 2026-07-21 13:41:45