# Webhooks overview

Instead of making repeated API calls, a client may subscribe to notifications from Squarespace for supported system events.

To receive notifications from Squarespace for a merchant site, 
create a webhook subscription using the [Webhook Subscriptions API](/commerce-apis/webhook-subscriptions-overview). 

You can use the [send test notification](/commerce-apis/send-test-notification) endpoint to test your subscriptions.

## When will a subscription expire?

Subscriptions never expire.

## Which events can I subscribe to?

See "Event notifications" below for a full list.

## How can I verify a notification is from Squarespace?

Every Squarespace notification includes a `Squarespace-Signature` header.
To verify this header, you must have access to the `secret` from a returned `Webhook Subscription`.

`secret` is only returned when [creating a subscription](/commerce-apis/create-webhook-subscription) or when [rotating a secret](/commerce-apis/rotate-subscription-secret).

Read the [Verifying notifications](/webhooks/verifying-notifications) guide for further details about verifying notifications.

## Structure of a Squarespace notification

Squarespace webhook notifications are sent as a request to a subscribed webhook endpoint.
The request always contains headers, including a signature, and a JSON payload.

_Note: Squarespace reserves the right to add properties and fields without a version change. Version changes are reserved for breaking changes only._

### Headers

`User-Agent`: "Squarespace/1.0"
`Content-Type`: "application/json"
`Squarespace-Signature`: "<an HMAC-SHA256 signature>"

###  Payload

```javascript
{
  // String; unique notification id
  "id": "5c2ba184b63ed3cb411ce2b1",
  // String; Squarespace website id that triggered the notification.
  "websiteId": "5f3c3d55ac435e1a051f77b3",
  // String; unique Webhook Subscription id
  "subscriptionId": "5f3c2155d947844beedda991",
  // String; description of the event that triggered the notification.
  "topic": "extension.uninstall",
  // ISO 8601 UTC date and time string; represents when the notification was created.
  "createdOn": "2020-04-22T22:18+00:00",
  // Object; data associated with the event.
  "data": {...}
}
```

## Event notifications

Below is a list of events that trigger notifications.
Read the [Notification delivery](/webhooks/notification-delivery) guide to learn about the notification lifecycle. 

### Extension events

* [Extension uninstall](/webhooks/events/extension-uninstall)

### Commerce order events

Commerce order notifications require OAuth access permissions for the Commerce Orders API.
See the Commerce [Authentication and permissions](/commerce-apis/authentication-and-permissions) guide for details.

* [Order create](/webhooks/events/order-create)
* [Order update](/webhooks/events/order-update)

### Contact events

Contact notifications cover **contact** lifecycle (`contact.*`) and **address book** changes (`address.*`). 
A **contact** is a person associated with a Squarespace site — such as a customer, subscriber, or donor — as described in the [Contacts API overview](/commerce-apis/contacts-overview). 
Subscribing to these events requires permissions — see [Authentication and permissions](/commerce-apis/authentication-and-permissions).

**Contact**

* [Contact create](/webhooks/events/contact-create)
* [Contact update](/webhooks/events/contact-update)
* [Contact delete](/webhooks/events/contact-delete)

**Address**

* [Address create](/webhooks/events/address-create)
* [Address update](/webhooks/events/address-update)
* [Address delete](/webhooks/events/address-delete)