Narvar Shopify RMA Spec

This endpoint is used to send the status of the return, refunds and exchanges to third party systems. The webhook is triggered by Narvar whenever there is a change in the returns data due to data received by Narvar, or a user action on the Narvar platform.

Basic Auth Username Password Verification

You will provide Narvar with a username and password that Narvar will encode using Base64 and pass as the Basic Auth parameter. Pseudocode is given below.

header = "#{webhook.basic_username}:#{webhook.basic_password}"
b64 = Base64.encode64(header)
{
    'Authorization' => "Basic " + b64,
    'Content-Type' => 'application/json'
}

This API endpoint allows you to send Narvar approval of items after receiving them in your warehouse. This can also be triggered by your ERP systems. If you want Narvar to issue a partial refund, you have to set the refund override amounts. By default, if an item is marked as not_received, then that item won’t be refunded.

Refund amount changes

If only a partial refund needs to be issued, you need to specify the refund_override amount for each of the item, as well as any order level refund_adjustment ( this would have been shipping and handling fees we would show end user), and the final total_refund_override amount. We will ensure that total of all the item level refunds amounts and the refund_adjustment amounts add up to total_refund_override amount.

Basic Auth with HMAC Verification

Narvar will provide you with an application_secret that will be used in the Basic Auth verification creation.

The basic auth username will be current timestamp in UTC as epoch seconds. For reference, Saturday, February 27, 2021 11:15:24 AM will be 1614424524.

The password is the signature generated using a hash-based message authentication code (HMAC) with SHA-256 and the application secret shared with you directly by your Narvar Implementation engineer i.e. HMAC.SHA256( application_secret, signed_payload) where signed_payload is created by concatenating the timestamp ( passed as username), the character ‘.’ and the actual JSON payload (i.e. the request body).

You will provide Narvar with a username and password that Narvar will encode using Base64 and pass as the Basic Auth parameter.

Pseudocode (Ruby) is given below.

user_name = Time.now.to_i
signed_payload = user_name + "." + body.to_json
password = OpenSSL::HMAC.hexdigest("SHA256", application_secret, signed_payload)
header = "#{user_name}:#{password}"
b64 = Base64.encode64(header)
{
    'Authorization' => "Basic " + b64,
    'Content-Type' => 'application/json'
}