Skip to main content

Webhooks

A webhook is an inbound HTTP endpoint. Its URL has the form https://<automator host>/webhook/<profile>/<environment>/<identifier>.

A webhook has a webhook type:

  • Xurrent: used for webhooks sent by Xurrent.
  • Generic: used for any other external system.

For Xurrent webhooks, the automator supports JWT authentication (see below) and automatically handles verification. In addition, you can specify which Xurrent events trigger a package, for more fine-grained control over when a package is executed.

info

Xurrent events on record types with a high rate of change, such as request.update, can lead to many unnecessary package executions. We recommend using the automation_rule event instead. Create an automation rule in Xurrent that calls a webhook endpoint at the automator when specific preconditions are met.

Authentication​

Generic webhooks always use HTTP basic authentication.

Xurrent webhooks support three methods:

  • HTTP basic authentication: click Create webhook URL to generate a username and password. The URLs with the credentials are shown once; configure one of them as the webhook URL in the external system.
  • JWT, policy based authorization using manually configured public key: the requests carry a JWT that is signed by a webhook policy in Xurrent. Paste the public key of the policy, set the audience field, and (optionally) specify the used encryption algorithm and the issuer.
  • JWT, policy based authorization using OpenID Connect discovery: same as the above, but the automator retrieves the public keys of the policy from Xurrent, so no key has to be pasted. Keys rotated in Xurrent are picked up automatically.

For the JWT methods, the automator also checks the issuer of the token. If you leave it empty, the issuer is determined on first use: the first token that is signed by a policy on a Xurrent domain pins its issuer to the webhook, and from then on only tokens from that issuer are accepted.