Webhooks¶
Brighte uses webhooks to provide event notification. Webhooks are HTTP callbacks that receive notification messages of consumer application status updates. Webhooks can be created using the Vendor Portal or using the REST API.
When a change to the consumer application status occurs, Brighte issues an HTTP POST notification message to your webhook’s URL. Your server is expected to return a status code of either 200 (Success) or 406 (Not Acceptable) to indicate the message has been successfully received. For any other code, the message will be resent for 8 hours at the following intervals before stopping: 10 minutes, 10 minutes, 15 minutes, 30 minutes, 1 hour, 2 hours and 4 hours.
The webhook is called with the following parameters:
| Parameter | Description |
|---|---|
| id | Consumer application identifier |
| reference_number | Consumer application reference number |
| status | Consumer application status |
| timestamp | Number of seconds passed since 1 January 1970 |
| token | Randomly generated string of length 50 |
| signature | String with hexadecimal digits generated by HMAC algorithm |
Sample payload:
{
"id":"BRIGHTEID",
"reference_number":"BRIGHTEREF",
"status":"APPROVED",
"timestamp":"946684800",
"token":"b08c02e08efec9e34611c5141e5f698bff949f95999e687ecc",
"signature":"4743b5be4b4eddebb7fc43d6bff001a067e1c7e11c69a2d022fb465e4e6ae4e8"
}
Verifying request¶
Your server must verify that notification messages originated from Brighte using the signature parameter.
To verify the authenticity of the message:
- Concatenate the
timestampandtokenvalues. - Encode the string with the HMAC method using your Private API Key (encoded in a UTF-8 format) and the SHA256 algorithm.
- Compare the calculated message digest with the signature.