A request went out to the market

POST

To the request’s owner. Fetch it with GET /shipment-requests/{id} (requests:read). Every delivery is a POST with a JSON body and four headers: Quatlas-Event-Id (the event’s id; dedupe on it, a delivery can arrive more than once), Quatlas-Event-Type, Quatlas-Timestamp (Unix seconds) and Quatlas-Signature: v1=, the lowercase hex HMAC-SHA256 of “.” keyed with your subscription’s signing secret (whsec_…). During a secret rotation the header carries one v1= value per valid secret, comma-separated; accept the delivery when any one matches. Compute the HMAC over the raw bytes you received, compare in constant time, and refuse a timestamp more than 5 minutes from your clock (replay). Answer any 2xx within 10 seconds to acknowledge; anything else, a redirect included, is retried after 1 minute, 5, 30, 2 hours, 6 and 12. After 20 failures in a row the subscription is switched off. Bodies are thin on purpose: fetch the details through the read API with your key’s scopes.

Parameters

Header Parameters

Quatlas-Event-Id

required

string

The event’s id (uuid). The same event delivered twice carries the same id: dedupe on it.

Quatlas-Event-Type

required

string

The event’s type: request.published.

Quatlas-Timestamp

required

string

When this delivery was signed, in Unix seconds. Refuse one more than 5 minutes from your clock.

Quatlas-Signature

required

string

V1=<hex HMAC-SHA256(secret, “.”)>, one value per valid secret, comma-separated.

Request Body^required

Media typeapplication/json

The body of a request.published delivery.

object

data

required

The identifying fields, and the facts this type carries.

object

dealId

required

The deal the event is about, when there is one.

null | string format: uuid

dealNumber

required

The deal’s business number (DEAL-206447), once there is a deal.

null | string

externalReference

required

Your own reference for the request, only when your company owns it.

null | string

metadata

Your metadata on the request: only in a delivery to your company when it owns the request and has set some. Absent otherwise; never sent to another company.

object

key

additional properties

string

quoteNumber

required

The quote’s business number (QTE-731905): the winning quote once a deal exists, or the offer that arrived on request.bid_received.

null | string

requestNumber

required

The request’s business number (REQ-048213), when there is a request.

null | string

shipmentNumber

required

The operation’s business number (SHPT-012618), once the deal went live.

null | string

shipmentRequestId

required

The request the event is about, when there is one.

null | string format: uuid

id

required

The event’s id, also in Quatlas-Event-Id.

string format: uuid

livemode

required

False for a sandbox (test integration) event and for webhook.test.

boolean

occurredAt

required

When the fact became true (UTC).

string format: date-time

type

required

The event’s type.

string

Allowed value: request.published

Responses

2XX

Any 2xx within 10 seconds acknowledges the delivery.