Sign up

Webhooks

Check that an event is from Goomzo, and manage your endpoints.

verify_webhook checks an event's signature and timestamp, and returns the event. See Signatures.

Requirements

  • An endpoint, and its signing secret, which starts with whsec_. See Webhooks.

Receive an event

Pass the body exactly as it arrived, before parsing it:

Flask
import os
from flask import Flask, request
from goomzo import WebhookVerificationError, verify_webhook

app = Flask(__name__)

@app.post('/webhooks/goomzo')
def goomzo_webhook():
    try:
        event = verify_webhook(request.get_data(), request.headers, os.environ['GOOMZO_WEBHOOK_SECRET'])
    except WebhookVerificationError:
        return '', 400
    if event['type'] == 'message.delivered':
        mark_delivered(event['data']['id'])
    return '', 204
FastAPI
from fastapi import FastAPI, HTTPException, Request

app = FastAPI()

@app.post('/webhooks/goomzo', status_code=204)
async def goomzo_webhook(request: Request) -> None:
    try:
        event = verify_webhook(await request.body(), request.headers, os.environ['GOOMZO_WEBHOOK_SECRET'])
    except WebhookVerificationError:
        raise HTTPException(400)
    ...

Important: Don't parse the body as JSON before checking it. The signature is of the body as it arrived.

Manage endpoints

endpoint = goomzo.webhook_endpoints.create({
    'url': 'https://example.com/webhooks/goomzo',
    'events': ['message.delivered', 'message.failed'],
})
endpoint['secret']  # whsec_…
MethodDoes
webhook_endpoints.list()Lists your endpoints.
webhook_endpoints.get(id)Gets one.
webhook_endpoints.update(id, changes)Changes an endpoint, or turns it off.
webhook_endpoints.delete(id)Deletes one.

Next steps

Last updated