Walmart Webhooks

When to Use This Skill

• How do I receive Walmart Marketplace webhooks?
• How do I verify Walmart webhook signatures (WM_SEC.SIGNATURE)?
• How do I handle PO_CREATED, INVENTORY_OOS, or BUY_BOX_CHANGED events?
• Why is my Walmart webhook signature verification failing?
• Setting up a Walmart performance webhook endpoint

Verification (core)

Walmart Marketplace performance webhooks sign each delivery with HMAC-SHA256 keyed on a shared webhook secret. The signature is not over the raw body directly — Walmart builds a canonical string from four components joined by newlines, then HMACs that:

<HTTP_METHOD>\n<REQUEST_PATH_AND_QUERY>\n<WM_SEC.TIMESTAMP>\n<SHA256_HEX_OF_RAW_BODY>