Webhooks: Receiving Real-Time Events

{
  "name": "crm-sync-prod",
  "description": "Delivers funding events to our CRM ingestion service",
  "webhook_url": "https://your-domain.com/webhook-handler",
  "headers": ["Authorization: Bearer your_token"],
  "payload_format": "json"
}

{
  "response_context": {
    "correlation_id": "f6bf2bf8c0e34f3d9fa000f83398c97b",
    "request_status": "success",
    "time_taken_in_seconds": 0.2
  },
  "webhook_id": "wh_9f2c81ab",
  "scope": { "type": "tenant", "id": "con_dJJUz1jfqdwzfM4t" },
  "name": "crm-sync-prod",
  "webhook_url": "https://your-domain.com/webhook-handler",
  "payload_format": "json",
  "status": "active",
  "webhook_secret": "generated_secret_key",
  "created_at": "2026-07-28T09:00:00Z",
  "last_modified_time": "2026-07-28T09:00:00Z"
}

import base64
import hashlib
import hmac
import time
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()

# One secret per webhook_id — store securely
WEBHOOK_SECRETS = {
    "wh_9f2c81ab": "generated_secret_key",
}
TIME_WINDOW_SECONDS = 300  # 5 minutes

def verify_signature(secret, payload, received_signature, received_timestamp):
    try:
        request_time = int(received_timestamp)
    except ValueError:
        return False  # Invalid timestamp

    # Check if timestamp is within the acceptable window
    current_time = int(time.time())
    if abs(current_time - request_time) > TIME_WINDOW_SECONDS:
        return False  # Reject old requests

    hmac_key = base64.urlsafe_b64decode(secret.encode('utf-8'))

    # Recreate message with timestamp + Payload
    message = f"{received_timestamp}.{payload.decode('utf-8')}".encode("utf-8")

    computed_hmac = hmac.new(hmac_key, message, hashlib.sha256)
    computed_signature_b64 = base64.urlsafe_b64encode(computed_hmac.digest()).decode('utf-8')
    return hmac.compare_digest(computed_signature_b64, received_signature)

@app.post("/webhook-handler")
async def receive_event(request: Request):
    """Receive and validate webhook events."""
    payload = await request.body()
    received_signature = request.headers.get("X-Signature")
    received_timestamp = request.headers.get('X-Timestamp')

    # Ensure Content-Type is application/json
    content_type = request.headers.get('Content-Type', '')
    if not content_type.startswith('application/json'):
        raise HTTPException(status_code=415, detail="Content-Type must be application/json")

    event_data = await request.json()

    # The payload names its delivering webhook — verify with that webhook's secret
    secret = WEBHOOK_SECRETS.get(event_data.get('webhook_id', ''))
    if not secret or not received_signature or not received_timestamp or \
            not verify_signature(secret, payload, received_signature, received_timestamp):
        raise HTTPException(status_code=400, detail="Invalid signature")

    # Route based on enrollment_key, event_name, and entity id
    enrollment_key = event_data.get('enrollment_key')
    event_name = event_data.get('event_name')
    # ...

    return {"message": "Webhook processed successfully"}

{
  "response_context": {
    "correlation_id": "7f53fa0b79fd4edf9fce50d1e530aac7",
    "request_status": "success",
    "time_taken_in_seconds": 0.563
  }
}

{
  "simulation": {
    "event_name": "new_funding_round",
    "number_of_events": 3
  }
}

{
  "enrollment_key": "my_b2b_saas_monitor",
  "webhook_id": "wh_9f2c81ab",
  "event_types": ["ipo_announcement", "new_funding_round"],
  "business_ids": ["8adce3ca1cef0c986b22310e369a0793"]
}

{
  "response_context": { "correlation_id": "…", "request_status": "success", "time_taken_in_seconds": 0.2 },
  "enrollment_key": "my_b2b_saas_monitor",
  "enrollment_id": "en_7b429a01",
  "webhook_id": "wh_9f2c81ab",
  "status": "active"
}

{
  "webhook_id": "wh_9f2c81ab",
  "tenant_id": "con_dJJUz1jfqdwzfM4t",
  "partner_id": "ExpTest",
  "event_id": "691377c2df80547c70e26a13216a3944",
  "event_name": "new_funding_round",
  "enrollment_key": "my_b2b_saas_monitor",
  "enrollment_id": "en_7b429a01",
  "entity_type": "business",
  "business_id": "57e7fd862b2ac1c9358bccf8e90faeb1",
  "event_time": "2026-07-28T09:41:55Z",
  "data": { "…": "…" }
}