Webhook payload

Every time LX CloudPos fires a webhook, it makes a POST with Content-Type: application/json and the identification and signature headers. This is the full format of the request that arrives at the integrator’s endpoint:


POST https://tu-app.com/webhooks/lxs HTTP/1.1
Content-Type: application/json
X-Lxs-Signature: sha256=a1b2c3d4e5f6...
User-Agent: LxCloudPos-Webhook/1.0


{
  "evento": "hacienda.estado",
  "clave": "50615012600310112345600100001010000000123456789012",
  "numero_consecutivo": "00100001010000000123",
  "tipo_documento": "01",
  "ind_estado": "aceptado",
  "mensaje": "",
  "timestamp": "2026-05-15T14:32:45.1234567Z",
  "intento": 1,
  "nonce": "9f8a2b3c4d5e6f70a1b2c3d4e5f60718"
}

The body is a JSON object with the event’s fields. The X-Lxs-Signature header contains the HMAC-SHA256 signature in sha256=<hex> format; validating it is mandatory (see HMAC verification).

Fields

Field	Type	Meaning
`evento`	string	Event type. Currently only `"hacienda.estado"`.
`clave`	string	The document’s 50-digit key.
`numero_consecutivo`	string	20-digit consecutive number.
`tipo_documento`	string	`"01"` FE, `"02"` ND, `"03"` NC, `"04"` TE.
`ind_estado`	string	`"aceptado"`, `"rechazado"`, etc. (from Hacienda).
`mensaje`	string	Optional message from Hacienda (errors on rejection).
`timestamp`	string	ISO 8601 UTC timestamp of the webhook.
`intento`	number	Attempt number (1-based).
`nonce`	string	Random hex hash unique per attempt. For dedup.