Webhooks for partners#

POST https://example.com/webhooks HTTP/1.1
Content-Type: application/json
{
  "events": [
    {
      "id": null,
      "created_at": "2018-08-03T12:00:00.000Z",
      "action": "disconnected",
      "resource_type": "organisations",
      "links": {
        "organisation": "OR123"
      },
      "details": {
        "cause": "app_disconnected",
        "origin": "gocardless",
        "description": "Your app has been has disconnected from this organisation"
      },
      "metadata": {}
    }
  ]
}

<?php
function process_organisation_event($event)
{
    switch ($event->action) {
        case "disconnected":
            print("Organisation " . $event->links->organisation . " has been disconnected!\n");
            MarkOrganisationAsDisconnected($event->links->organisation);
            break;
        default:
            print("Don't know how to process an organisation " . $event->action . " event\n");
            break;
    }
}

$webhook_endpoint_secret = getenv("GOCARDLESS_WEBHOOK_ENDPOINT_SECRET");
$request_body = file_get_contents('php://input');

$headers = getallheaders();
$signature_header = $headers["Webhook-Signature"];

try {
    $events = \GoCardlessPro\Webhook::parse(
        $request_body,
        $signature_header,
        $webhook_endpoint_secret
    );

    foreach ($events as $event) {
        print("Processing event " . $event->id . "\n");

        switch ($event->resource_type) {
            case "organisations":
                process_organisation_event($event);
                break;
            default:
                print("Don't know how to process an event with resource_type " . $event->resource_type . "\n");
                break;
        }
    }

    header("HTTP/1.1 200 OK");
} catch (\GoCardlessPro\Core\Exception\InvalidSignatureException $e) {
    header("HTTP/1.1 498 Invalid Token");
}

# Here, we're using a Django view, but essentially the same code will work in
# other Python web frameworks (e.g. Flask) with minimal changes
import os
import logging

from django.views.generic import View
from django.views.decorators.csrf import csrf_exempt
from django.utils.decorators import method_decorator
from django.http import HttpResponse

from gocardless_pro import webhooks, Client
from gocardless_pro.errors import InvalidSignatureError

from myinvoicingapp.models import GoCardlessEvent

# Handle the incoming Webhook and perform an action with the Webhook data.
class Webhook(View):
    logger = logging.getLogger(**name**)

    @method_decorator(csrf_exempt)
    def dispatch(self, *args, **kwargs):
        return super(Webhook, self).dispatch(*args, **kwargs)

    def post(self, request, *args, **kwargs):
        try:
            for event in self._get_events(request):
                self.process(event)
            return HttpResponse(204)
        except InvalidSignatureError:
            return HttpResponse(498)

    def process(self, event):
        self.logger.info("Processing event {}\n".format(event.id))

        if event.resource_type == 'organisations':
            return self.process_organisation_event(event)
        # ... Handle other resource types
        else:
            self.logger.info("Don't know how to process an event with \
                resource_type {}\n".format(event.resource_type))

    def process_organisation_event(self, event):
        if event.action == 'disconnected':
            self.logger.info(
                "Organisation {} has been disconnected\n".
                format(event.links.organisation)
            )
        else:
            self.logger.info("Don't know how to process an event with \
                resource_type {}\n".format(event.resource_type))

    def _get_events(self, request):
        secret = os.environ['GC_WEBHOOK_SECRET']
        signature = request.META["HTTP_WEBHOOK_SIGNATURE"]
        body = request.body.strip()
        return webhooks.parse(body, secret, signature)

require 'gocardless_pro'

class OrganisationEventProcessor
  def self.process(event, response)
    case event.action
    when 'disconnected'
      response.stream.write("Organisation #{event.links.organisation} has been disconnected\n")

      DisconnectOrganisation.enqueue(event['links']['organisation'])
    else
      response.stream.write(
        "Don't know how to process a organisation #{event.action} event\n"
      )
    end
  end
end

def create
  # We recommend storing your webhook endpoint secret in an environment variable
  # for security
  webhook_endpoint_secret = ENV['GOCARDLESS_WEBHOOK_ENDPOINT_SECRET']

  # In a Rack app (e.g. Sinatra), access the POST body with
  # `request.body.tap(&:rewind).read`
  request_body = request.raw_post

  # In a Rack app (e.g. Sinatra), the header is available as
  # `request.env['HTTP_WEBHOOK_SIGNATURE']`
  signature_header = request.headers['Webhook-Signature']

  begin
    events = GoCardlessPro::Webhook.parse(
      request_body: request_body,
      signature_header: signature_header,
      webhook_endpoint_secret: webhook_endpoint_secret
    )

    events.each do |event|
      # We're using Rails's streaming functionality here to write directly to the
      # response rather than using views, as one would usually.
      response.stream.write("Processing event #{event.id}\n")

      case event.resource_type
      when 'organisations'
        OrganisationEventProcessor.process(event, response)
      else
        response.stream.write(
          "Don't know how to process an event with resource_type #{event.resource_type}\n"
        )
      end
    end

    response.stream.close
    render status: 200
  rescue GoCardlessPro::Webhook::InvalidSignatureError
    render status: 498
  end
end

package hello;

// Use the POM file at
// https://raw.githubusercontent.com/gocardless/gocardless-pro-java-maven-example/master/pom.xml

import com.gocardless.errors.InvalidSignatureException;
import com.gocardless.resources.Event;
import com.gocardless.Webhook;
import java.util.List;
import org.springframework.http.HttpStatus;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestHeader;
import org.springframework.http.ResponseEntity;

@RestController
public class HelloController {
    private String processDisconnections(Event event) {
        switch (event.getAction()) {
            case "disconnected":
                // here, you probably want to mark the organisation as disconnected
                // and stop sending any requests on their behalf
                return "Organisation " + event.getLinks().getOrganisation() +
                    " has been cancelled.\n";
            default:
                return "Do not know how to process an event with action " +
                    event.getAction() + ".\n";
        }
    }

    private String processEvent(Event event) {
        switch (event.getResourceType()) {
            case ORGANISATIONS:
                return processDisconnections(event);
            default:
                return "Don't know how to process an event of resource_type " +
                    event.getResourceType().toString() + ".\n";
        }
    }

    @PostMapping("/")
    public ResponseEntity<String> handlePost(
            @RequestHeader("Webhook-Signature") String signatureHeader,
            @RequestBody String requestBody) {
        String webhookEndpointSecret = System.getenv("GOCARDLESS_WEBHOOK_ENDPOINT_SECRET");

        try {
            List<Event> events = Webhook.parse(requestBody, signatureHeader, webhookEndpointSecret);

            String responseBody = "";

            for (Event event : events) {
                responseBody += processEvent(event);
            }

            return new ResponseEntity<String>(responseBody, HttpStatus.OK);
        } catch (InvalidSignatureException e) {
            return new ResponseEntity<String>("Incorrect Signature", HttpStatus.BAD_REQUEST);
        }
    }
}