Webhook Object Details

Status Changelog Dashboard Create a Ticket
Search…
Webhook Format
Key
Type
Description
_id.$oid
String
Object ID of webhook
client_id
String
Object ID of Client
date
Integer
Date webhook was created (milliseconds since Unix epoch time)
function
String
Resouce | Method
http_response_code
String
Response code from webhook URL
http_response_text
String
Response text from webhook URL
http_responses[]
Array
List of response data from webhook URL. See Webhook Response Object (below) for more information.
http_url
String
URL webhook was sent to
object_id
String
Object ID attached to resource type
safe_obj._id.$oid
String
Object ID of resource
safe_obj._rest
Object
Contains information about the resource (node, transaction, user, subnet objects)
safe_obj.webhook_meta
Object
Contains information about webhook subscription updates (e.g. who the object was updated by, function used to perform the update, etc)
safe_obj.webhook_meta.function
String
The function associated with the webhook (e.g. "NODE|PATCH")
safe_obj.webhook_meta.log_id
String
The ID of the log associated with the webhook
safe_obj.webhook_meta.updated_by
String
Who updated the webhook subscription (e.g. "SELF", "BACKEND, etc)
safe_obj.webhook_meta.date.$date
Integer (milliseconds since Unix epoch time)
The wehbook creation date
safe_obj_hash
String
Hashed object information
updated_by
String
For internal use
Best key to Query
The _rest key is the best key to query by, as it matches what you receive from the API.
Webhook URL Response Object
Key
Type
Description
date
Integer
Date webhook received a response from webhook URL. Use of this value is recommended for ordering webhook responses when receiving them from Synapse.
http_response_code
String
Response code from webhook URL
http_response_text
String
Response text from webhook URL
http_url
String
URL webhook was sent to
HMAC for Webhooks
Every webhook is signed with HMAC.
HMAC is a protocol that helps you judge the authenticity of the received message. This comes in handy when you want to quickly find out whether the webhook was sent by Synapse or a malicious/notorious party.
The signature is a SHA-1 and SHA-256 HMAC hash of the object_id + your client_id, with the secret key as your client_secret.
Please note: Python (FullBody) uses the entire body of a webhook to create a signature, which can be used to rebuild a X-Synapse-Signature-SHA256-FullBody signature.
You will be able to rebuild the signature the following way:
Python
Python (FullBody)
1
import hmac 
2
from hashlib import sha1, sha256
3
​
4
key = 'your_client_secret'
5
raw = '{0}+{1}'.format(payload['_id']['$oid'],'your_client_id')
6
​
7
hashed_sha1 = hmac.new(key, raw, sha1)
8
hashed_sha256 = hmac.new(key, raw, sha256)
9
​
10
# The signature
11
print hashed_sha1.hexdigest()
12
print hashed_sha256.hexdigest()
Copied!
1
import hmac 
2
from hashlib import sha1, sha256
3
import json
4
​
5
webhook = json.loads(json.dumps(payload,sort_keys=True))
6
​
7
key = bytes('your_client_secret','utf-8')
8
raw = bytes(webhook,'utf-8')
9
​
10
hashed_sha256 = hmac.new(key, raw, sha256)
11
​
12
# The signature
13
print(hashed_sha256.hexdigest())
Copied!
Please note that raw should look like this (with +):
563db3fb86c27307d925871f+e3f19e4bd4022c86e7f2
Not like this (without +):
563db3fb86c27307d925871fe3f19e4bd4022c86e7f2.
Since the SHA-1 signature is in hex, it should look like this:5bce964c20b0c36313d8f7cffc2ff4772d0c96750
We then take this signature and add it into the header of the request with name X-Synapse-Signature and X-Synapse-Signature-Sha256.
Subscription Object Details
Testing on UAT
Last modified 20d ago
Export as PDF
Copy link
Contents
Webhook Format
Webhook URL Response Object
HMAC for Webhooks