How do I get a webhook for DPD and PostNL tracking?

curl -X POST https://api.lastscanned.com/v1/watches \
  -H "Authorization: Bearer lsk_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"trackingNumber": "3STBDG061270842", "metadata": {"order": "1042"}}'

curl -X POST https://api.lastscanned.com/v1/watches \
  -H "Authorization: Bearer lsk_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"trackingNumber": "15504366056765", "carrier": "dpduk", "metadata": {"order": "1042"}}'

const res = await fetch("https://api.lastscanned.com/v1/watches", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.LASTSCANNED_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ trackingNumber: "15504366056765", carrier: "dpduk", metadata: { order: "1042" } }),
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(res.status, await res.json());

import os
import requests

r = requests.post(
    "https://api.lastscanned.com/v1/watches",
    headers={"Authorization": f"Bearer {os.environ['LASTSCANNED_KEY']}"},
    json={"trackingNumber": "3STBDG061270842", "metadata": {"order": "1042"}},
    timeout=60,
)
r.raise_for_status()
print(r.status_code, r.json())

{
  "id": "evt_63e401d5f73a4c31ef8fa8d9",
  "type": "tracking.updated",
  "createdAt": "2026-11-14T18:20:36Z",
  "data": {
    "watch": {
      "id": "wat_109060ade9f9a48732117f7a",
      "trackingNumber": "3STBDG061270842",
      "carrier": "postnl",
      "metadata": { "order": "1042" }
    },
    "previousStatus": "in_transit",
    "result": {
      "carrier": "postnl",
      "trackingNumber": "3STBDG061270842",
      "status": "out_for_delivery",
      "statusDescription": "<newest observation>",
      "service": null,
      "deliveredAt": null,
      "deliveredAtLocal": null,
      "signedBy": null,
      "destination": { "city": null, "state": null, "country": null },
      "events": []
    }
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

// Lastscanned-Signature: t=<unix seconds>,v1=<hex>
// v1 is HMAC-SHA256 of "<t>.<raw body>", keyed with the secret from PUT /v1/webhook.
export function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=", 2)));
  const expected = createHmac("sha256", secret).update(`${parts.t}.${rawBody}`).digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(parts.v1 ?? "", "hex");
  return fresh && a.length === b.length && timingSafeEqual(a, b);
}

import hashlib, hmac, time

def verify(raw_body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    expected = hmac.new(secret.encode(), f"{parts['t']}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return abs(time.time() - int(parts["t"])) < tolerance and hmac.compare_digest(parts["v1"], expected)