Handle paginated carrier responses and implement webhook receivers for tracking updates.
Pagination Patterns
Carrier APIs use offset-based (page/limit), cursor-based (next_cursor), or link-header pagination. Cursor-based is most reliable for real-time data. Always drain all pages — a partial sync means missing shipments.
Webhook Fundamentals
Carriers push tracking updates via webhooks. Your receiver must: return 200 quickly (process async), validate signatures, handle duplicates (use event IDs), and handle out-of-order delivery. Never do heavy processing in the webhook handler.
Carrier Reality
FedEx webhook payloads can arrive out of order. A 'delivered' event might arrive before 'out for delivery.' Use the event timestamp, not arrival order, to determine the current status.
Webhook Security
Verify webhook signatures using HMAC-SHA256. Compare the signature header against your computed hash of the raw body + shared secret. Reject requests with invalid or missing signatures. Use constant-time comparison to prevent timing attacks.