API

Delivio Integration API

Create orders from your own system, read their status, cancel them.

Authentication

Create the key on the client page in the panel. A key belongs to one client; which client the order is for comes from the key, not the body.

Authorization: Bearer dlv_live_xxxxxxxxxxxx_…

Create an order

The address and the amount are enough. Sending coordinates makes courier matching and the ETA more accurate.

curl -X POST https://delivio.talivio.com/api/v1/integration/orders \
  -H "Authorization: Bearer $DELIVIO_KEY" \
  -H "Idempotency-Key: siparis-1042" \
  -H "Content-Type: application/json" \
  -d '{
    "address": "Moda Cad. 12/3",
    "customer_name": "Ada",
    "customer_phone": "+90 555 000 00 00",
    "total": 24000,
    "is_prepaid": true
  }'

Amounts are INTEGERS in minor units (24000 = 240.00). Floats are rejected.

Send an Idempotency-Key: retrying the same request after a dropped connection will not create a second order.

{
  "data": { "id": 1042, "code": "S-1042", "status": 15, "…": "…" },
  "tracking_url": "https://delivio.talivio.com/t/…"
}

Read status and cancel

curl https://delivio.talivio.com/api/v1/integration/orders/1042 -H "Authorization: Bearer $DELIVIO_KEY"

curl -X POST https://delivio.talivio.com/api/v1/integration/orders/1042/cancel \
  -H "Authorization: Bearer $DELIVIO_KEY" \
  -d 'reason=Müşteri vazgeçti'

Once a courier takes the order, API cancellation closes (409): a POS request cannot turn back a courier already on the way — cancel from the panel.

Errors

Webhooks

Set your endpoint on the client page in the panel. We POST when an order is accepted, picked up, delivered and cancelled.

POST /sizin-ucunuz
X-Delivio-Event: order.delivered
X-Delivio-Signature: t=1755680000,v1=9f2c…

{
  "event": "order.delivered",
  "sent_at": "2026-08-20T12:00:00+00:00",
  "order": { "id": 1042, "code": "S-1042", "status": 20, "…": "…" }
}

Every request carries `X-Delivio-Signature: t=<unix>,v1=<hmac>`. To verify, compute `hmac_sha256(your_secret, "<t>." + raw_body)` and compare with `v1`; reject if `t` is older than 5 minutes (replay).

// PHP
[$t, $v1] = sscanf($_SERVER['HTTP_X_DELIVIO_SIGNATURE'], 't=%d,v1=%s');
$expected = hash_hmac('sha256', $t.'.'.file_get_contents('php://input'), $secret);

if (! hash_equals($expected, $v1) || abs(time() - $t) > 300) {
    http_response_code(400);
    exit;
}

If your endpoint does not answer 2xx we retry after 10s, 1m, 5m and 30m. After 20 consecutive failures the endpoint is disabled and the panel says why.