Request Structure

Headers

Inbound webhook requests must include the following headers.

X-Webhook-Key-Id

The 8 character ID of the shared secret key used for signing the request.

X-Webhook-Timestamp

The webhook request timestamp in unix timestamp format (seconds).

The timestamp is appended to the request body to create the request signature along with a secret key; see Request Signing.

The timestamp tolerance is five minutes. Webhooks sent with a timestamp outside the tolerance will be rejected with a 400 Bad Request error.

X-Webhook-Signature

The request signature is a hex-encoded HMAC-SHA-256 digest of the exact request body with the request timestamp appended with a version identifier prefix.

Example: v1=d86e21aed80e267c100054bc90ae82a97f33a015e75d1ead02cea1a292e0d3a0

Multiple signatures can be sent if new signature versions are introduced in the future.

Example: v1=d86e21aed80e267c100054bc90ae82a97f33a015e75d1ead02cea1a292e0d3a0, v2=8f27d3854165cc6bfb3ac2b258b28f44702e6b035ae569adba0e67e0254a4ca8

Body

The webhook request body is a JSON object with a standard set of top-level properties.

See Inbound Events for all possible values for these properties.

type

The event type.

version

The event version.

data

The event data. Other properties under this one will differ for each event.