Webhooks setup and validation

Prerequisite

You need to set up and run a web server to receive webhook notifications on your system.

Create and add webhooks to a workflow

To ensure that webhooks are securely sent from CFT, follow these steps:

Create and configure webhooks in the Admin portal.

Important: CFT does not support webhook endpoints that use the default AWS API Gateway endpoint, which follows the URL format .execute-api.ap-southeast-1.amazonaws.com.

If you are using AWS API Gateway for a webhook endpoint, we recommend setting up a custom domain for your API Gateway. Your custom domain must also use Route 53 to route to API Gateway with an A Alias record.

Add your webhook to a workflow in the Admin portal.

Validate webhooks

Generate the webhook signature using the webhook signature token and compare that signature with the signature you received in the webhook payload.

To validate the webhook notifications, follow these steps:

Generate the webhook signature using the SHA-256 hash function, based on:
- The webhook signature token as an HMAC key
- An HMAC digest of the request payload
Compare the secret or webhook signature token with the hash value of x-cft-signature from the header.

Sample code for validation

# Import necessary libraries
import json
import hmac
import hashlib
import base64

# Function to create a HMAC-SHA256 signature for a message
def create_message_signature(message, secret):

    # Convert the message into a JSON string
    message_string = json.dumps(message, separators=(‘,’, ‘:’))

    # Create a HMAC-SHA256 signature of the JSON string using the secret key
    signature = hmac.new(bytes(secret, ‘utf-8’), msg = bytes(message_string, ‘utf-8’), digestmod = hashlib.sha256).digest()

    # Return the base64-encoded signature
    return base64.b64encode(signature).decode()

# Usage

# JSON string to be converted into a Python dictionary
json_string = ‘{}’ # replace with notification JSON string from CFT

# Convert the JSON string into a Python dictionary
message = json.loads(json_string)

# Secret key to be used for creating the signature
secret = “” # replace with your actual secret configured in CFT portal

# Create the signature
signature = create_message_signature(message, secret)

# Print the signature
print(signature)

Overview

Payload samples