> ## Documentation Index
> Fetch the complete documentation index at: https://api.vitarelay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Push a status or inventory update

> Send an order `status_update` (with tracking) or an `inventory_update` (stock/cost per product). Sign the exact raw JSON body with your inbound webhook secret and send it in the `x-vitarelay-signature` header (hex or base64; a leading `sha256=` prefix is tolerated).



## OpenAPI

````yaml /pharmacy-api/openapi.yaml post /pharmacy-webhook/{orgId}
openapi: 3.1.0
info:
  title: VitaRelay Pharmacy API
  version: 1.0.0
  description: >-
    Inbound webhook for partner pharmacies to push order fulfillment status,
    tracking, and inventory updates into VitaRelay (pharmacy → VitaRelay).
    Orders are dispatched TO your system through a separate pharmacy-specific
    onboarding channel that is not part of this API.


    All requests are signed with a per-pharmacy inbound webhook secret using
    HMAC-SHA256 over the exact raw request body. The secret is issued and
    rotated by a VitaRelay admin.
  contact:
    name: VitaRelay
    url: https://vitarelay.com
servers:
  - url: https://vitarelay.com/api/public
    description: Production
security:
  - webhookSignature: []
tags:
  - name: Fulfillment
    description: Push order status, tracking, and inventory from your pharmacy system.
paths:
  /pharmacy-webhook/{orgId}:
    post:
      tags:
        - Fulfillment
      summary: Push a status or inventory update
      description: >-
        Send an order `status_update` (with tracking) or an `inventory_update`
        (stock/cost per product). Sign the exact raw JSON body with your inbound
        webhook secret and send it in the `x-vitarelay-signature` header (hex or
        base64; a leading `sha256=` prefix is tolerated).
      parameters:
        - name: orgId
          in: path
          required: true
          description: >-
            Your pharmacy's VitaRelay organization UUID (provided by a VitaRelay
            admin).
          schema:
            type: string
            format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              oneOf:
                - $ref: '#/components/schemas/StatusUpdate'
                - $ref: '#/components/schemas/InventoryUpdate'
            examples:
              status_update:
                summary: Order status + tracking
                value:
                  event: status_update
                  order_number: VR-20260804-118342
                  status: shipped
                  tracking_number: 1Z999AA10123456784
                  tracking_carrier: ups
                  tracking_url: https://www.ups.com/track?tracknum=1Z999AA10123456784
              inventory_update:
                summary: Stock & cost updates
                value:
                  event: inventory_update
                  products:
                    - ndc_code: 12345-6789-01
                      in_stock: true
                      wholesale_cost_cents: 4200
                    - name: Testosterone Cypionate 200mg/mL
                      in_stock: false
      responses:
        '200':
          description: Accepted and processed.
          content:
            application/json:
              schema:
                type: object
                properties:
                  ok:
                    type: boolean
                  note:
                    type: string
              example:
                ok: true
                note: order VR-20260804-118342 updated
        '400':
          description: Invalid org id or payload.
        '401':
          description: Invalid or missing signature.
        '404':
          description: Integration not enabled for this org.
components:
  schemas:
    StatusUpdate:
      type: object
      required:
        - event
      properties:
        event:
          type: string
          enum:
            - status_update
        order_number:
          type: string
          maxLength: 100
          description: >-
            VitaRelay order number. A retry suffix like `-r2` is tolerated and
            normalized.
        status:
          type: string
          enum:
            - accepted
            - processing
            - ready_to_ship
            - shipped
            - delivered
        tracking_number:
          type: string
          maxLength: 200
        tracking_carrier:
          type: string
          maxLength: 80
        tracking_url:
          type: string
          format: uri
          maxLength: 500
    InventoryUpdate:
      type: object
      required:
        - event
        - products
      properties:
        event:
          type: string
          enum:
            - inventory_update
        products:
          type: array
          maxItems: 500
          items:
            type: object
            description: Match a product by ndc_code (preferred) or name.
            properties:
              ndc_code:
                type: string
                maxLength: 40
              name:
                type: string
                maxLength: 200
              in_stock:
                type: boolean
              wholesale_cost_cents:
                type: integer
                minimum: 0
                description: >-
                  Your wholesale cost in cents. Never exposed publicly by
                  VitaRelay.
  securitySchemes:
    webhookSignature:
      type: apiKey
      in: header
      name: x-vitarelay-signature
      description: >-
        HMAC-SHA256 of the exact raw request body, keyed with your per-pharmacy
        inbound webhook secret. Hex or base64; optional leading `sha256=`.

````