XML Postback

receive an xml copy of an order after it is placed.

UltraCart Webhooks supercede the XML Postback.  They are superior in every way.  

Please see the API page for help using webhooks.

XML Postback

UltraCart's XML Post Back feature gives merchants the opportunity to have orders automatically "posted" to their server shortly after the order is placed. Orders will be transmitted in XML (Extensible Markup Language) format. Once received, they can have any number of functions automatically performed based on any parameters within the order.
Merchants might consider utilizing the post back function for the following reasons:

  • Automatically receive orders shortly after they are placed.
  • For doing any validation or other processing on their server side.
  • Receive updated order status automatically (optional).

The XML Post Back feature should only be used by advanced merchants with software development skills or with programmers at their disposal. Presently, UltraCart does not provide script templates.
There are two requirements to make the XML Post Back possible. A merchant must:

  1. have a web server that supports HTTPS (secure sockets), and
  2. create (or have created) a script that will;
    1. receive the order (one order per post),
    2. perform the desired functions, and
    3. send a "return success" code 200 to UltraCart.

XML Postback Script on Your Server

Several languages can and are used for receiving and performing functions with the XML format. Some examples are; PHP, Perl, Python, C#, ASP, Java, Ruby, and Cold Fusion. Here is an example PHP Script that you can use to get started. You will need to embellish it with your back-end business logic.
The XML message posted back is equivalent to manually exporting 1 order in the XML W3C Schema format from Order Management  Export Orders.

Programmers need to be aware that the XML is within the HTTP body, not in parameters.

Post Back Configuration

Prior to configuring the Post Back feature insure that you have your script in place on your server. Once that is completed, log in to your UltraCart account and navigate to:

Main Menu Configuration Back Office XML Post Back

Once you click on the XML Postback link, the following screen will appear:

Most merchants will chose to use one or the other of the two options listed here. You may use both. The URL's tell UltraCart where to post the XML file to and the name of the script itself.

UltraCart will not send duplicate notifications. If you configure the second option (stage changes), you will not receive any notifications via the first option. Instead, when an order is placed, you'll receive a postback with the appropriate stage change (depends on the status/success of the order).

First Option: Transmit to URL when order placed

Placing the URL into this field will tell UltraCart to post back any order when and only when the order is created. UltraCart will continue to post back the order to your server until it receives a "return success" code (200).

Second Option: Transmit to URL when stage changes

Placing the URL into this field will tell UltraCart to post back any order when the status (stage) of an order changes.
The status will appear in the current_stage field. The status (stage) values are:

current_stage status



Accounts Receivable


Completed Order


Inserting (Placed Order)


Pending Clearance (of Check Orders, and Amazon Payment orders)




Quote Request


Quote Sent




Shipping Department

Once you've entered the URL into the appropriate field, click on the "Save" button at the bottom of the screen. Your configuration is complete.

Third Option: Transmit Auto Order Status to URL when auto order changes

Placing the URL into this field will tell UltraCart to post back when an auto order changes.

Auto Order Update XML details
  status = active, card declined, cancelled upgrade, cancelled downgrade, cancelled, terminated

If you use the second option "Transmit to URL when stage changes" then UltraCart will also send you an XML postback when a refund occurs.  When refunds occur the order can be in multiple stages (SD or CO typically) so you will want to look for the following elements in the XML:

  • subtotal_discount_refunded

  • subtotal_refunded

  • other_refunded

  • tax_refunded

  • shipping_handling_refunded

  • buysafe_refunded

  • total_refunded

  • refund_dts

If a refund has occurred, the elements "total_refunded" and "refund_dts" will always exist.  The other elements mentioned above will exist if that component of the order was refunded.

Passing Postbacks To Mutliple URLs

Multiple Postback URL's

If you need to configure multiple XML Postback URL's, separate each URL with a space.

While multiple URL's can be configured, we don't recommend more than 2-3 URL's, because all of the configured scripts must succeed. If any one of the scripts returns an unsuccessful reponse, UltraCart will retry the postback to each of the configured postback URL's.


Since the information sent to your server is critical to your business operation, UltraCart records logs of each transmission. To access the logs
click on the Log button as shown below.

When you click on the log it will show you the order id, timestamp, and result for each transmission. Notice that we can quickly see that UltraCart
is having trouble connecting to this server.

For each transmission you can see what is sent to your server and what is returned as shown below.

Notice that UltraCart is logging the response back from your server. It only cares about the 200 result code to determine success, but logging
the response from your server allows you to output information that you can review in the logs for debugging purposes.

Restarting Postbacks After Errors Have Halted Postback Processing

If UltraCart encounters 50 consecutive errors from your server, it will disable the XML postback and email you. The transmissions will queue up until you edit your XML Postback configuration.

After reviewing the logs to determine the cause of the errors. To restart the processing of the queued orders, re-save the XML PostBack settings (Click the save button on the XML Postback configuration page.)

Understanding HTTP Errors 

The table below covers common HTTP result codes that UltraCart may encounter from your server.

301Moved Permanently
302Moved Temporarily (Redirect)
400Bad Request
404Not found (the script doesn't exist on your server)
405Method Not Allowed (Your script doesn't support POST)
500Internal Error (your script blew chunks)

The complete list can be found at http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html

How do I resend historical data to my server via XML postback?

Identify the first and last order id for the range of data that you want to resend to your new XML postback URL.  Use the batch order operation utility to populate the XML postback queue.


Orders with partial refunds will report the item Id's of the refunded items, whereas complete refunds will not include the item Id's by default.

Please Note

If you need the complete refunds to report the item ID's in the order, contact UltraCart by emailing support@ultracart.com stating your UltraCart MerchantID requesting that we enable the merchant property "XML Postback - Skip Adjustment for Refund". 

With this property is enabled, it will prevent refunded items from being removed from the XML postback, so you will see these items in your refund transaction XML packet.

Pay close attention to these optional elements that will indicate the refunding of the item:

  • quantity_refunded
  • total_refunded 

Handling Read Timeouts

The XML postback process will wait at most 60 seconds for a response from your web server.  Do not try and perform complex processing of the XML postback document on your receiver.  Simply queue up the XML document in a persistent storage (database, Redis, SQS, etc.) and then perform your more complex processing in a decoupled fashion.  This will allow you to receive a greater velocity of XML postbacks from UltraCart and fan out the processing of those postbacks appropriately. 

Frequently Asked Questions (FAQ)

 Q: "I notice that there's an <order> xml element, and that there could be more than one. Is it often that post backs come in with multiple orders in them?"

 A: The XML Postback transmissions are always a single order only.

 Q: Are the merchant notes, special instructions, gift message, and comments transmitted in the XML document?

 A: Yes, if they are present on the order then they are populated in the XML.  We don't populate empty elements for these fields though.  The element names are:

  • special_instructions
  • comments
  • gift_message
  • merchant_notes

    Please consult the XML Schema for a full description of the XML document structure.
 Q: My server is returning a 500 error code. What does that mean?

 A: When your server returns a 500 error it means that the code on the other side (your side) has experience an unhandled error condition.  Typically that is a null pointer exception, database error, etc.  Please check your server logs for further details.

 Q: When an order is successfully charged to the customer's credit card and goes to my Fulfillment Queue, what is its XML stage state while in the queue?

 A: XML postback does not recognize that it's held in the fulfillment transmission queue. The state of the order will be the shipping department so the current_stage element in the XML will read "SD".
    (NOTE: The XML will not register a new stage change until the order is either marked as shipped (which would trigger the XML stage "CO" or if the order were to be marked as "Rejected" then the XML would read "REJ")

 Q: When an order goes to the A/R queue either because of a fraud issue or a shopping cart timed out, besides an "AR" state, did it ever have an "IN" status?

A: IN = Inserting, so it's just an initial stage while the order record is being processed. If you actually seeing these in XML postbacks to your system, email Support with the orderID for review (it's something that really should not appear in most cases.

 Q: When that A/R order is successfully processed (credit card) and goes to the Fulfillment Held Queue?

A: In this situation, the stage changes from "AR" to "SD" and an XML postback will occur if you have it configured to send one when stages change.

 Q: I'm trying to find if there's: (1) a flag indicating it's an auto-order AND (2) a way to tie it back to the original order?

 A: If the order is an auto order there will be these elements in the XML:

  • auto_order_code
  • auto_order_original_order_id
 Q: Is there a postback when an Auto order is cancelled? (updated 9/1/2014)

 A: Yes. The auto order configuration now has a separate configuration field "Transmit Auto Order Status to URL when auto order changes" for auto orders. 
     If configured, auto order cancellations will trigger a XML Postback transmission when status changes.

 Q: Our XML transmission appear to have stopped yesterday, why is that?

 A: UltraCart will disable the XML postback after 50 consecutive non HTTP 200 responses. UltraCart will continue to queue up the requests and will send them only once the merchant goes back into the XMP Postback configuration page and saves the configuration, which reset the hold and releases the queued orders from immediate transmission. (So for example if you were doing some database maintenance for an hour that interrupted the transmissions, you would need to resave the settings to get things processing again.)

 Q: Why does the postback not happen instantaneously after the order is processed?

 A: XML postback requests are added to a queue when the order is placed.  The queue is processed asynchronously by a background job once a minute.  The number of postbacks that can be handled each cycle depends upon the throughput speed of the remote servers.  Performing the postbacks in the background makes sure a merchant's slow or unresponsive server does not destabilize the front end of the platform.  If there is a large spike in orders to the platform, the number of cycles to clear out the postback queue will vary.

 Q: What information is in the order XML postback?

 A: The complete XSD schema file for the order XML postback is located here: http://secure.ultracart.com/xml/ultracart.xsd

 Q: Can I configure more than one URL within one of the three configuration fields?

 A: Yes. To configure more than one URL into one of the URL configuration fields, simply separate each URL with a SPACE. 

PLEASE NOTE: Both endpoints must be able to deal with duplicates. If any endpoint fails, the postback is marked as a failure and when retried, each endpoint gets the postback again.    

 When the postback occurs does it always pass the full set of customer data including custom fields?

There is quite a bit of order information in the XML postback, including customer data and the custom fields 1-7.

 Is there a way it identifies it self as an auto-order vs an initial order?

On an order XML postback there is an element for the auto_order information. Inside that element there is a field for auto_order_original_order_id. If that is the same as the order_id in the XML document then this is the original order in the auto order sequence. If it's different then it's a rebill.

 Just to clarify for each successful auto-order charge it will go through the main postback URL right? (not the auto-order status change URL)

Orders go through one URL and auto order status information through another. They can be the same URL if you want to configure it that way and just teach the one script to parse the XML document and then look at the content differently.

 For the auto-order status change postback, do you have an XML schema for that? or is it the same as the normal postback? is their a particular field that we should check for?

There is not a schema file for this yet, but the easiest thing to do is configure a dummy URL, let the auto order XML postback fire, and then check the log under the XML postback configuration to see a copy of the document it tried to send.

 We moved our XML Postback script to a new server via Cloudflare, and since then then our XML Postback is not longer working and is now disabled.

At this point in time you cant configure an XML postback to a URL that is fronted by Cloudflare. (XML postback requires a non-SNI hosted environment.)