Skip to main content
WEBHOOK

Authorizations

webhook-signature
string
header
required

Webhook deliveries are signed, not bearer-authenticated. Each request carries a webhook-signature header (an HMAC over webhook-id, webhook-timestamp, and the raw request body). Verify it with the signing secret returned when you registered the endpoint before trusting the payload, and reject deliveries whose signature does not match.

Headers

webhook-signature
string
required

The delivery signature. Verify it with your endpoint signing secret before trusting the payload.

webhook-id
string
required

Unique delivery id, included in the signed content and usable for idempotency.

webhook-timestamp
string
required

Delivery timestamp, included in the signed content. Reject deliveries whose timestamp is outside your tolerance window.

Body

application/json

The bid-family binding of the webhook envelope: the concrete shape delivered for bid events, where type is one of the bid.* event types and data is the bid payload — the bid that changed, plus the posting, freight, and carrier it relates to.

eventId
string
required

A unique identifier for this event delivery. Use it to deduplicate incoming webhooks — if the same eventId arrives more than once (for example, after a network retry), treat the second delivery as a no-op.

actorId
string
required

The actor that triggered this event, expressed as a prefixed identifier:

  • usr_<userId> when the action was taken by a Cargado user (broker or carrier acting through the Cargado UI).
  • api_<apiKeyId> when the action was taken via the public API using one of your API keys.
type
enum<string>
required

The kind of bid event being delivered (for example, bid.submitted or bid.counter_accepted). Use this to route the payload to the right handler on your side.

Available options:
bid.submitted,
bid.accepted,
bid.rejected,
bid.revoked,
bid.closed,
bid.countered,
bid.counter_accepted,
bid.counter_revoked,
bid.counter_rejected
timestamp
string<date-time>
required

The time the event occurred, as an ISO-8601 timestamp. This is the time of the underlying state change, not the time the webhook was delivered.

data
object
required

The payload of a bid webhook event. Contains the bid that changed along with the posting, freight, and carrier it relates to.

Response

2XX

Return a 2xx status to acknowledge the event.