walmart-webhooks

name	walmart-webhooks
description	Receive and verify Walmart Marketplace performance webhooks. Use when setting up Walmart webhook handlers, debugging WM_SEC.SIGNATURE HMAC-SHA256 signature verification, or handling seller events like PO_CREATED, INVENTORY_OOS, BUY_BOX_CHANGED, and RETURN_CREATED.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Walmart Webhooks

When to Use This Skill

• How do I receive Walmart Marketplace webhooks?
• How do I verify Walmart webhook signatures (WM_SEC.SIGNATURE)?
• How do I handle PO_CREATED, INVENTORY_OOS, or BUY_BOX_CHANGED events?
• Why is my Walmart webhook signature verification failing?
• Setting up a Walmart performance webhook endpoint

Verification (core)

Walmart Marketplace performance webhooks sign each delivery with HMAC-SHA256 keyed on a shared webhook secret. The signature is not over the raw body directly — Walmart builds a canonical string from four components joined by newlines, then HMACs that:

<HTTP_METHOD>\n<REQUEST_PATH_AND_QUERY>\n<WM_SEC.TIMESTAMP>\n<SHA256_HEX_OF_RAW_BODY>

• Method — uppercased (POST).
• Path + query — the request path , exactly as received.