v1

latestOpenAPI 3.1.02026-07-243035381.4 MB
Notifications

Enable HMAC webhook digest

This endpoint is compatible with our deprecated v3 Notifications product. To use it with v3, simply replace 'v4' with 'v3' in the request URL.

<p style="display: none">/v4/subscription</p> <p>Enable HMAC hash ID on the fired webhooks from Tatum API. In order to make sure that a webhook is sent by us, we have the possibility to sign it with the HMAC Sha512 Hex algorithm.<br/> To verify that a webhook is sent by us <ol> <li>Get a webhook <b>x-payload-hash</b> header value and payload as it is as a JSON file.</li> <li>Convert the HTTP webhook body to stringify JSON without any spaces. In JavaScript, you would do it like this <pre>JSON.stringify(req.body)</pre></li> <li>Perform calculations on your side to create a digest using Secret Key, webhook payload in bytes and HMAC SHA512 algorithm. JavaScript example: <pre>require('crypto').createHmac('sha512', hmacSecret).update(JSON.stringify(req.body)).digest('base64')</pre>.</li> <li>Compare x-payload-hash header value with calculated digest as a Base64 string.</li></p>
put/v4/subscription

Request body

hmacSecretstring required

Your HMAC secret password, which is used for signing the webhook payload.

Example request

{
  "hmacSecret": "1f7f7c0c-3906-4aa1-9dfe-4b67c43918f6"
}

Response

OK