This guide will help you integrate with BaseKit’s Webhooks.
What are Webhooks
“A webhook is an HTTP request, triggered by an event in a source system and sent to a destination system, often with a payload of data. Webhooks are automated, in other words they are automatically sent out when their event is fired in the source system.”
– Hookdeck
Webhooks in BaseKit can be used to connect events on the BaseKit platform, with external services.
For example, it is possible to send data to an external service, such as Zapier, each time a customer publishes their site.
How to use Webhooks
To make use of Webhooks, you must first be subscribed. This is managed by an extension to our REST API, which enables subscription management. A REST API consumer can subscribe to an event, by supplying an event to subscribe to, and a webhook URL, which our system will send a payload to.
Event Payloads
For each event on the BaseKit platform, an associated payload is sent to the connected webhook subscription.
account_holder.created
account_holder.package_change
booking.updated
site.first_publish
site.publish
store.order_updated
Zapier Integration
Zapier is an automation platform that connects your apps and moves information between them based on rules you set. Zapier workflows are called Zaps and enable this connection between applications. A Zapier workflow can be initiated by a Webhook, using a trigger called “Catch Raw Hook in Webhooks by Zapier”.
A basic Zap will look much like this
When you create an integration with BaseKit’s webhooks, you first create your Zap, and then you will find your Webhook URL within the Zapier UI as below. This URL is the URL which you create a subscription with using the Create Subscription Endpoint.
HMAC Authentication
Webhooks should always be delivered over HTTPS for security. Webhook endpoints however, by their very nature, are often open to any source system that knows their URL. A common defense to guarantee data integrity, and security from remote exploitation, is to implement HMAC Authentication. BaseKit sends a HMAC signature with all outgoing Webhooks using the X-Delivery-Hmac-SHA256 header, which a consumer can optionally validate.
To make use of HMAC Authentication you will need to request for a HMAC Secret to be generated within your environment. This secret will be used to sign the webhook when it is delivered by BaseKit, and to validate the request at the destination.
It is then possible with Zapier, for example, to validate the Webhook using an advanced workflow as below. This workflow uses Zapier Secret Storage to securely store the HMAC Secret generated above.
Using the “Run JavaScript in Code” trigger and the example code below, you can validate the request has originated at BaseKit.