Sign up

Webhooks

Check that an event is from Goomzo, and manage your endpoints.

goomzo.VerifyWebhook checks an event's signature and timestamp, and returns the event. See Signatures.

Requirements

  • An endpoint, and its signing secret, which starts with whsec_. See Webhooks.

Receive an event

Pass the body exactly as it arrived, before decoding it:

http.HandleFunc("POST /webhooks/goomzo", func(w http.ResponseWriter, r *http.Request) {
	body, err := io.ReadAll(r.Body)
	if err != nil {
		http.Error(w, "can't read the body", http.StatusBadRequest)
		return
	}
	event, err := goomzo.VerifyWebhook(body, r.Header, os.Getenv("GOOMZO_WEBHOOK_SECRET"))
	if err != nil {
		http.Error(w, "bad signature", http.StatusBadRequest)
		return
	}
	if event.Type == "message.delivered" {
		var msg goomzo.Message
		if err := json.Unmarshal(event.Data, &msg); err == nil {
			markDelivered(msg.ID)
		}
	}
	w.WriteHeader(http.StatusNoContent)
})

event.Data is the event's data as it came. Decode it into a goomzo.Message, a goomzo.Customer, or your own struct, by event.Type.

Important: Don't decode the body before checking it. The signature is of the body as it arrived.

Manage endpoints

endpoint, err := client.WebhookEndpoints.Create(ctx, goomzo.WebhookEndpointInput{
	URL:    "https://example.com/webhooks/goomzo",
	Events: []string{"message.delivered", "message.failed"},
})
endpoint.Secret // whsec_…
MethodDoes
WebhookEndpoints.List(ctx)Lists your endpoints.
WebhookEndpoints.Get(ctx, id)Gets one.
WebhookEndpoints.Update(ctx, id, changes)Changes an endpoint, or turns it off.
WebhookEndpoints.Delete(ctx, id)Deletes one.

Next steps

Last updated