Application lifecycle webhooks

Outreach allows for registering a webhook URL for getting notifications about lifecycle events of your application. To configure webhooks add the "Application lifecycle webhooks" feature to your app and specify the URL which is going to be called.

Configuring application lifecycle webhooks

Every time your application is installed, updated or reconfigured by an Outreach organization, your webhook will be called with the following payload:

Copy

Copied

{
  "data": {
    "type": "install",
    "id": "INSTALL_ID",
    "relationships": {
      "app": {
        "data": {
          "type": "app",
          "id": "S2S_GUID"
        }
      }
    }
  },
  "meta": {
    "deliveredAt": "2019-01-01T00:00:00",
    "eventName": "install.created"
  }
}

When uninstalled, the value of eventName will be install.deleted. When calling webhooks Outreach will set the following additional HTTP headers:

Header	Description
Content-Type	`application/vnd.api+json`
Outreach-Webhook-ID	UUID generated specifically for this request.
Outreach-Webhook-Signature	HMAC digest of the request body and your specified webhooks secret. See below for information on how to calculate this signature.

Validating webhook requests

To validate webhook requests calculate the SHA256 HMAC and compare it with the value of Outreach-Webhook-Signature header. Outreach calculates this value as follows:

Copy

Copied

OpenSSL::HMAC.hexdigest(
  OpenSSL::Digest.new("sha256"),
  OUTREACH_WEBHOOK_SECRET,
  request_body

You can find the OUTREACH_WEBHOOK_SECRET value in the webhook configuration page.