Webhook

A webhook inverts the usual direction. Rather than the client asking repeatedly whether anything has changed, it registers a URL of its own, and the server makes an HTTP request to that URL when an event occurs. The client becomes, for those requests, a server.

How it works

You subscribe by giving the provider a URL and usually receiving a shared secret. When an event fires, the provider POSTs a payload to that URL, signing it — typically an HMAC over the raw body, in a header. Your endpoint verifies the signature, responds quickly with a 2xx, and does the actual work afterwards. Providers retry non-2xx responses, so deliveries can and will arrive more than once.

The misconception

That receiving a webhook means the event is true. An unverified webhook endpoint is a public URL anybody can POST anything to. The signature is not optional, and it must be computed over the exact raw bytes received — parsing and re-serialising the JSON first is the single most common reason a correct implementation fails to verify.

Try it here

The Webhooks API lets you subscribe, trigger a delivery, read the `x-funapi-signature` header and verify it — then tamper with the payload and watch verification fail.

Related

• Testing webhooks and HMAC signature verification
• What an HMAC signature is

Other terms

• Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
• REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
• ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
• HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
• Bearer token — A credential where possession alone grants access — whoever holds it can use it.
• JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.

All glossary terms · Testing techniques · All 39 mock REST APIs