Signed Webhook Deliveries

• Signature verification- When Strata Cloud Manager sends a webhook, it computes an HMAC-SHA256 signature over the raw JavaScript Object Notation (JSON) payload using a unique signing secret and includes the signature in the X-Hub-Signature-256 request header. The signature header uses the versioned v1= prefix standard. Your receiving endpoint recomputes the signature using the same secret and compares the result to confirm authenticity. Signature verification is optional; existing webhook integrations continue to work without changes if you don't implement verification on your receiving endpoint.
• Signing secret scope - The signing secret is scoped to individual notification profiles rather than the entire tenant. This design reduces risk when you operate multiple webhook integrations because rotating the secret for one profile doesn't affect any other profile.
• Secret management and rotation - Strata Cloud Manager generates the signing secret for each webhook profile. You can copy your signing secret after you generate it. For your security, the secret isn't shown again after you navigate away or refresh the page. Rotating your secret is an optional security practice and isn't mandatory. If you choose to rotate your secret, the previous secret remains valid for a 72-hour grace period so you have time to update your verifying systems. During this grace period, Strata Cloud Manager sends both the primary and legacy signatures in the same header, separated by a comma (for example, X-Hub-Signature-256: v1=<primary_hash>,v1=<legacy_hash>). Configure your receiving endpoint to split the header on the comma and verify if your active secret matches either v1= value.

{
    "resource": "/{webhook+}",
    "path": "/webhook/none",
    "httpMethod": "POST",
    "headers": {
        "Accept": "*/*",
        "Accept-Encoding": "gzip, deflate, zstd",
        "Authorization": "Bearer qqq",
        "Content-Type": "application/json",
        "Host": "XXXXXXXXXXXXXXXXXXXXX",
        "User-Agent": "python-requests/2.32.5",
        "X-Amzn-Trace-Id": "Root=1-XXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
        "X-Forwarded-For": "192. l68.1.1",
        "X-Forwarded-Port": "443",
        "X-Forwarded-Proto": "https",
        "X-Hub-Signature-256": "v1=*****************************02ff6b0151ba**********"
    },
    "multiValueHeaders": {
        "Accept": [
            "*/*"
        ],
        "Accept-Encoding": [
            "gzip, deflate, zstd"
        ],
        "Authorization": [
            "Bearer qqq"
        ],
        "Content-Type": [
            "application/json"
        ],
        "Host": [
            "XXXXXXXXXXXXXXXXXXXXXXXXXXX"
        ],
        "User-Agent": [
            "python-requests/2.32.5"
        ],
        "X-Amzn-Trace-Id": [
            "Root=1-XXXXXXXXXXXXXXXXXXXXXXXXXXX"
        ],
        "X-Forwarded-For": [
            "192. l68.1.1"
        ],
        "X-Forwarded-Port": [
            "443"
        ],
        "X-Forwarded-Proto": [
            "https"
        ],
        "X-Hub-Signature-256": [
            "v1=*****************************02ff6b0151ba**********"
        ]
    },
.
.
.
.

{
    "resource": "/{webhook+}",
    "path": "/webhook/bearer",
    "httpMethod": "POST",
    "headers": {
        "Accept": "*/*",
        "Accept-Encoding": "gzip, deflate, zstd",
        "Authorization": "Bearer 896334fe750**************************",
        "Content-Type": "application/json",
        "Host": "XXXXXXXXXXXXXXXXXXXXXXXXXXXX",
        "User-Agent": "python-requests/2.32.5",
        "X-Amzn-Trace-Id": "Root=1-XXXXXXXXXXXXXXXXXXXXXXX",
        "X-Forwarded-For": "192. l68.1.1",
        "X-Forwarded-Port": "443",
        "X-Forwarded-Proto": "https",
        "X-Hub-Signature-256": "v1=***************************d9707a39db6f74d****************,v1=**************d8ea3a590f4e4c99******************************"
    },
    "multiValueHeaders": {
        "Accept": [
            "*/*"
        ],
        "Accept-Encoding": [
            "gzip, deflate, zstd"
        ],
        "Authorization": [
            "Bearer 896334fe750**************************"
        ],
        "Content-Type": [
            "application/json"
        ],
        "Host": [
            "XXXXXXXXXXXXXXXXXXXXXXXXXXXX"
        ],
        "User-Agent": [
            "python-requests/2.32.5"
        ],
        "X-Amzn-Trace-Id": [
            "Root=1-XXXXXXXXXXXXXXXXXXXXXX"
        ],
        "X-Forwarded-For": [
            "34.94.132.219"
        ],
        "X-Forwarded-Port": [
            "443"
        ],
        "X-Forwarded-Proto": [
            "https"
        ],
        "X-Hub-Signature-256": [
            "v1=***************************d9707a39db6f74d****************,v1=**************d8ea3a590f4e4c99******************************"
        ]
    },
.
.
.
.
.