Webhooks

​

Summary

Chift’s webhooks can be used to create custom applications that can react on specific events of the platform and of the unified APIs.

​

How can I manage my webhooks ?

• Webhooks can be managed through the UI in your account settings
• Webhooks can be managed through the API

​

Technical specifications

• On a specific event, a POST http request is sent to the webhook’s url
• It will contain a JSON payload with at least these attributes:

- accountid: guid of your Chift's account
- event: name of the event
- consumerid: guid of the consumer on which the event occurred
- created: timestamp (in sec) of the webhook event

• In the header it will contain as well the following attributes:

- X-Chift-Signature: encrypted signature of your body payload

​

X-Chift-Signature

X-Chift-Signature attribute can be used to make sure that incoming calls on your webhook endpoint are coming from Chift.

The X-Chift-Signature is generated based on the signing secret that you can optionally add when you create or update a webhook. It is based on the HMAC authentication method that relies on two keys. One is the signing secret that only you know and the second is the request body.

Most programming languages support HMAC hashes.

An example in NodeJS is the following:

const hash = crypto
.createHmac("sha256", encryption.decrypt(SIGNING_SECRET).toString())
.update(JSON.stringify(REQUEST_BODY), "utf-8")
.digest("hex");

An example in Python is the following:

import hmac
import hashlib
import json

json_data = json.dumps(REQUEST_BODY, separators=(',', ':'))
h = hmac.new(SIGNING_SECRET.encode(), json_data.encode(), hashlib.sha256)
hash = h.hexdigest()

By computing the hash on your endpoint, you can compare it whith the X-Chift-Signature attribute of the header to make sure that the request originated from Chift.

​

List of events

The table below describes the different webhook events that can be emitted on Chift. The additional payload in addition with the above attributes is what will be sent as part of the body to the webhook url.

Please refer as well to the Connection lifecycle section to have a better uderstand on when the connection webhooks are sent.