Webhooks

External services (payments, couriers, warehouses) send notifications to https://site.gr/whook.php?provider=<name>. The router runs only declared webhooks, and every declaration must define how it is verified.

add_filter('cms39_webhooks', function (array $w) {
    $w['stock'] = [
        'verify'  => 'key', 'key' => getenv('STOCK_WEBHOOK_KEY'),   // ?key=… or header X-Webhook-Key
        'methods' => ['POST'],
        'event'   => fn($req) => $req['json']['event_id'] ?? null,     // same event → runs once
    ];
    return $w;
});

function cms39_webhook_stock(array $req)
{
    foreach ($req['json']['items'] ?? [] as $item) {
        // update stock
    }
    return ['ok' => true];   // array → JSON
}

Verification

• 'verify' => 'key': a secret key (at least 16 characters)
• 'verify' => fn($req, $def) => …: the service signature / HMAC
• 'verify' => false: only for calls that change no data
• 'ips' => ['1.2.3.4']: an extra IP allow-list

Every notification is stored in cms39_webhook_events and shown under Settings → Webhooks log. If a service sends the same event again, it does not run twice.