Add the code below to your backend. WISM calls this endpoint to look up order status for every customer inquiry. Replace YOUR_VENDOR_API_KEY with your API key and YOUR_WEBHOOK_SECRET with your signing secret (both shown after account creation). The signature check ensures only WISM can call your endpoint.
// WISM Order Lookup Endpoint — add to your server
// Node.js / Express example
const express = require('express');
const crypto = require('crypto');
const router = express.Router();
// Verify WISM's HMAC-SHA256 signature on every request
function verifyWismSignature(req) {
const sig = req.headers['x-wism-signature'] || '';
const timestamp = req.headers['x-wism-timestamp'] || '';
const secret = process.env.WISM_WEBHOOK_SECRET; // YOUR_WEBHOOK_SECRET
const payload = timestamp + '.' + JSON.stringify(req.query);
const expected = 'sha256=' + crypto
.createHmac('sha256', secret)
.update(payload)
.digest('hex');
return crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
}
// WISM calls GET /wism/order?orderId=&email=
// Headers: X-Wism-Key, X-Wism-Signature, X-Wism-Timestamp
router.get('/wism/order', (req, res) => {
const apiKey = req.headers['x-wism-key'];
if (apiKey !== process.env.WISM_VENDOR_API_KEY) { // YOUR_VENDOR_API_KEY
return res.status(401).json({ error: 'Unauthorized' });
}
if (!verifyWismSignature(req)) {
return res.status(403).json({ error: 'Invalid signature' });
}
const { orderId, email } = req.query;
const order = db.findOrder({ orderId, email }); // query your DB here
if (!order) return res.status(404).json({ error: 'Order not found' });
// Return this structure — WISM reads all fields
res.json({
orderId: order.id,
customerEmail: order.email,
status: order.status, // e.g. "shipped"
carrier: order.carrier, // e.g. "PostNord"
trackingNumber: order.trackingNumber,
estimatedDelivery: order.eta, // ISO date string
items: order.items.map(i => ({ name: i.name, qty: i.qty, sku: i.sku }))
});
});
module.exports = router;
// Register: app.use('/api', router);
// Endpoint URL to enter in WISM dashboard:
// https://yourstore.com/api/wism/order
WISM.CC