Can Metrunio notify my system?

This is the opposite direction to “Can my system report conversions by webhook?”: there your system reports to Metrunio, here Metrunio reports to your system. Webhooks come with Growth and above, together with the read API and MCP.

{
  "id": "conversion:5f0c…",
  "type": "conversion.created",
  "created_at": "2026-10-10T09:41:00.000Z",
  "data": {
    "conversion_id": "5f0c…",
    "type": "purchase",
    "order_id": "10045",
    "value": 89.9,
    "set_value": 0,
    "currency": "EUR",
    "environment": "production"
  }
}

Verifying the signature

Every delivery carries the x-metrunio-signature header with t=<seconds>,v1=<hex>. v1 is HMAC-SHA256 over "<t>.<raw body>" with your signing secret, built as for incoming requests. Verify the signature on the raw body before processing it, and discard deliveries whose timestamp is older than five minutes.

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verify(header, rawBody, secret) {
  const parts = Object.fromEntries(header.split(',').map((part) => part.split('=')));
  if (Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) return false;
  const expected = createHmac('sha256', secret).update(`${parts.t}.${rawBody}`).digest();
  const received = Buffer.from(parts.v1 ?? '', 'hex');
  return received.length === expected.length && timingSafeEqual(received, expected);
}

The portal shows the signing secret exactly once, when you create the webhook. If it gets lost, renew it with “Renew secret”; the old one stops working.

Delivery and retries

• A 2xx response counts as delivered. Otherwise Metrunio retries after 1, 5, 15 and 60 minutes, then after 3, 6 and 12 hours; after 24 hours it gives up.
• Every attempt carries the same ID (id in the body, x-metrunio-delivery in the header). Process an event only once.
• Ten seconds per attempt. Metrunio does not follow redirects.
• Only https on port 443. Metrunio cannot reach addresses in your own network (localhost, private addresses).
• “Send test delivery” sends a signed ping event to the address; the log shows the last 50 deliveries.

• Production data only: a live test of your setup does not trigger a webhook.
• At most five webhooks per company.
• The log is kept for 30 days. Metrunio keeps the content of a delivery only until it has been delivered, given up or withheld.
• If you erase the data for an order number under "Privacy" or carry out an objection, Metrunio discards pending deliveries for it, retries included. The same applies when a visitor withdraws consent and the order is deleted as a result. The log then shows the delivery as "not sent (privacy)".
• Before every attempt Metrunio also checks whether the order number has been suppressed or the order deleted in the meantime. If so, nothing goes out.
• Deliveries that had already gone out are recorded when the request is carried out: endpoint, address and time go into the change log entry of the request (180 days) and into the API response. That lets you inform the recipient under Art. 19 GDPR. The delivery log itself is kept for 30 days.
• If your plan drops below Growth, no new deliveries go out; the webhooks stay in place.

Zapier and Make accept webhooks through a module of their own (“Webhooks by Zapier” at Zapier, “Webhooks” at Make). Enter the address it gives you here.