Goethena Webhooks API

Webhooks are not enabled by default, please work with your sales representative to have them enabled if you need them. Once you have access, webhooks can be managed through the API. Currently, only the following webhooks are supported: - Learner Training Campaign Completed # Security Requests to the webhook URL include a header `X-Signature`, which contains a signature of the payload. This signature is generated using the secret key provided when the webhook was created. ## Signature Verification To verify the signature of incoming requests, you need the secret key for a webhook. This key can be retrieved by calling `GET /v1/webhooks/{id}` after webhook creation. The secret key is not returned in the create webhook response. This key is used to generate a signature of the payload and compare it with the `X-Signature` header in the request. The signature is generated using the **HMAC SHA-256** algorithm. The **secret key** is used as the key, and the **request payload** is used as the data. The resulting HMAC is then converted into a hexadecimal string. For example: ```js const crypto = require('crypto'); const signature = crypto .createHmac('sha256', secretKey) .update(JSON.stringify(payload)) .digest('hex'); ``` In this example: 1. `secretKey` is the secret key that can be retrieved by calling `GET /v1/webhooks/{id}` after webhook creation. 1. `payload` is the data you receive in the webhook request (usually in JSON format). 1. The `crypto.createHmac()` function creates a hash object, which uses the SHA-256 algorithm and the `secretKey` as the key. 1. `update()` adds the stringified payload to the hash. 1. `digest('hex')` generates the HMAC hash in hexadecimal format, which can be compared to the `X-Signature` header in the request. # Retry Policy Webhook requests will be attempted up to **three times**, with a retry interval of **five minutes**, before being considered failed. A **30-second request timeout** is enforced, meaning the webhook request must complete within 30 seconds. If the request exceeds this timeout, the attempt will be considered failed.