How do I send Walmart Marketplace order notifications to Slashbin?

TL;DR: Walmart has no "add a webhook" screen. You subscribe to order notifications by making four calls to Walmart's Marketplace API, in order: get a token, check which events your account is allowed to receive, create the subscription, and send a test. This page walks each one, with every value you need to fill in shown as a placeholder.

The Problem

Most providers on this site give you a settings page: paste a URL, copy a secret, done. Walmart Marketplace does not. Notifications are switched on through the API, which is where sellers who are not developers get stuck:

• There are two different secrets, and they are easy to mix up. Your Walmart Client ID and Client Secret only get you an access token. The secret Walmart signs notifications with is a different one — Slashbin's inbound secret for your stream — and you hand it to Walmart yourself when you subscribe.
• You cannot subscribe to an event your account has not been granted. Walmart grants notification permission per resource. Asking for one you do not have fails, and the answer is not in any settings screen — you have to ask the API.
• The order event you route on is not the one Walmart names at the top. Every order notification arrives labelled ORDER_UPDATES. Whether it is a new order or a cancellation is one level deeper, in subEventType.

The Solution

Point Walmart at a Slashbin data stream. Slashbin checks every notification's signature at the gateway, stores the raw payload, routes on the order sub-event, and delivers to your destination with retries and replay. Your part is the four calls below — once.

Before you start: the four placeholders

Every request on this page uses these placeholders. Replace each with your own value when you send the request — never paste real values into a shared document or ticket.

Step 1: Create a Walmart Data Stream in Slashbin

1. In the Slashbin console, click Create New Data Stream and select Walmart.

2. Copy the stream's Ingestion URL. It looks like this:

   https://ingres.slashbin.io/api/ingest/<stream id>

   The console shows the exact URL for your stream — copy it from there rather than typing it.

3. Copy the stream's inbound secret. This is <SLASHBIN_INBOUND_SECRET> in the requests below.

Walmart sends its signature in the x-walmart-signature header, computed with HMAC-SHA256 over the request body, keyed by the inbound secret. Walmart does not publish which text form the signature is written in, so Slashbin's gateway accepts either form Walmart could send.

Step 2: Get a Walmart Access Token

Every Walmart Marketplace call needs an access token. Get one from the token endpoint with your Client ID and Client Secret:

POST https://marketplace.walmartapis.com/v3/token

Headers:
  Authorization: Basic base64(<WALMART_CLIENT_ID>:<WALMART_CLIENT_SECRET>)
  WM_SVC.NAME: Walmart Marketplace
  WM_QOS.CORRELATION_ID: <any unique id>
  Content-Type: application/x-www-form-urlencoded
  Accept: application/json

Body:
  grant_type=client_credentials

The Authorization value is the word Basic, a space, then your Client ID and Client Secret joined by a colon and Base64-converted. Most HTTP tools do this for you if you choose Basic Auth and enter the two values as username and password.

The response contains an access_token. That is <WALMART_ACCESS_TOKEN> for the next three steps. It expires after 900 seconds (15 minutes) — if a later step answers 401, get a fresh token and retry.

Step 3: Check Which Events Your Account Can Subscribe To

Before subscribing, ask Walmart which notifications your account is eligible for:

GET https://marketplace.walmartapis.com/v3/webhooks/eventTypes

Headers:
  WM_SEC.ACCESS_TOKEN: <WALMART_ACCESS_TOKEN>
  WM_SVC.NAME: Walmart Marketplace
  WM_QOS.CORRELATION_ID: <any unique id>
  Accept: application/json

The response lists events, each with a resourceName, an eventType, and an eventVersion. Permission is granted per resourceName. Find the entry for the resource you want — for order notifications, an entry whose resourceName is ORDER, for example:

{ "resourceName": "ORDER", "eventType": "PO_CREATED", "eventVersion": "V1" }

Note its three values exactly as returned. You will paste them into Step 4 and Step 5 unchanged.

Step 4: Subscribe Walmart to Your Slashbin Ingestion URL

Create the subscription. Use the three values from Step 3, your Ingestion URL from Step 1, and your Slashbin inbound secret:

Headers:
  WM_SEC.ACCESS_TOKEN: <WALMART_ACCESS_TOKEN>
  WM_SVC.NAME: Walmart Marketplace
  WM_QOS.CORRELATION_ID: <any unique id>
  Content-Type: application/json
  Accept: application/json

POST https://marketplace.walmartapis.com/v3/webhooks/subscriptions
{
  "events": [{ "eventType": "<eventType from step 3>", "eventVersion": "<eventVersion from step 3>", "resourceName": "<resourceName from step 3>",
    "eventUrl": "https://ingres.slashbin.io/api/ingest/<stream id>",
    "authDetails": { "authMethod": "HMAC", "authHeaderName": "x-walmart-signature", "clientSecret": "<SLASHBIN_INBOUND_SECRET>" },
    "status": "ACTIVE" }]
}

Three values in authDetails decide whether Slashbin accepts your notifications:

• authMethod is HMAC — Walmart signs each notification.
• authHeaderName is x-walmart-signature — the header Slashbin reads the signature from. Spell it exactly.
• clientSecret is <SLASHBIN_INBOUND_SECRET> — the inbound secret from your Slashbin stream, not your Walmart Client Secret.

Step 5: Send a Test Notification and Confirm It Arrived

Ask Walmart to send one test notification to your Ingestion URL, using the same authDetails:

POST https://marketplace.walmartapis.com/v3/webhooks/test

Headers: the same as Step 4

{
  "eventType": "<eventType from step 3>",
  "eventVersion": "<eventVersion from step 3>",
  "resourceName": "<resourceName from step 3>",
  "eventUrl": "https://ingres.slashbin.io/api/ingest/<stream id>",
  "authDetails": { "authMethod": "HMAC", "authHeaderName": "x-walmart-signature", "clientSecret": "<SLASHBIN_INBOUND_SECRET>" }
}

Then open your Walmart stream in Slashbin and check the Delivery Log:

• A verified notification means the header name and inbound secret match on both sides. You are done.
• A signature failure almost always means the clientSecret you sent is not this stream's inbound secret — most often the Walmart Client Secret pasted by mistake. Fix it in the subscription and send the test again.
• Nothing at all means Walmart did not reach the URL. Check the eventUrl is copied character for character from the console.

How Walmart Labels an Order Event

Every order notification arrives in the same envelope. The top-level event type is always ORDER_UPDATES; what actually happened is in payload.meta.subEventType:

{
  "source": { "eventType": "ORDER_UPDATES" },
  "payload": {
    "meta": { "subEventType": "PO_CREATED" }
  }
}

The fields that matter are shown; a real notification carries the full order alongside them.

Slashbin routes on the sub-event, not the envelope. A routing rule written for ORDER_UPDATES would match every order notification alike — new orders and cancellations together. Write your rules against PO_CREATED, INTENT_TO_CANCEL and the others, so a new order and a cancellation can go to different places.

Why Slashbin vs a Raw Handler

• No signature code to write. Slashbin checks x-walmart-signature against your inbound secret at the gateway, before anything reaches your systems.
• Routing on the real event. New orders and cancellations are separated by sub-event as a rule, not as code that digs into every payload.
• Every notification is kept. The raw payload is stored as Walmart sent it, so "did Walmart tell us about this order?" is one look at the Delivery Log.
• Nothing is a silent drop. If your destination is down, Slashbin retries with backoff, holds what it cannot deliver in the Dead Letter Queue, and replays on your schedule.

Next Steps

• Connect a provider that has no recipe yet — How do I receive webhooks from any provider?.
• Go deeper on mapping and validation — read Golden Model.
• Send one notification to more than one system — see Fan-Out Routing.
• Browse every supported source and destination on Integrations.