Aevum Zenth Webhooks

How Webhooks Work v2.1

When a configured event occurs within the Aevum Zenth ecosystem, our system sends a `POST` request to your registered URL. Each payload is signed using HMAC-SHA256 for verification.

HTTP Headers

Content-Type: application/json
X-Webhook-Signature: sha256=<signature>
X-Webhook-ID: whk_8f3d9a2c1b
X-Webhook-Timestamp: 1718492201
User-Agent: Aevum-Zenth-Webhooks/2.1

Supported Events

Event	Description	Scope
transaction.completed	Funds successfully settled to account	Finance
energy.grid.update	Real-time grid load or tariff change	Energy
health.record.access	Authorized access to medical records	Healthcare
aerospace.telemetry	Satellite or flight data stream update	Aerospace
security.alert	Threat detected or compliance flag raised	Global

Endpoint Configuration

Callback URL

Signing Secret (Auto-generated)

Active Events

transaction.completed Finance & Payments

energy.grid.update Utility Infrastructure

security.alert Global Security

Security & Verification

Always verify webhook signatures to ensure requests originate from Aevum Zenth. We use HMAC-SHA256 with your signing secret.

⚡

Best Practices

• Always verify the `X-Webhook-Signature` header
• Respond with a `200` or `204` within 5 seconds
• Handle retries idempotently (we retry up to 3 times)
• Use HTTPS endpoints only

Verification Examples

Node.js / Express

const crypto = require('crypto');

app.post('/webhook', (req, res) => {
  const sig = req.headers['x-webhook-signature'];
  const payload = JSON.stringify(req.body);
  const expected = crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(payload, 'utf8')
    .digest('hex');

  if (sig === `sha256=${expected}`) {
    // Process event
    res.status(200).send('Verified');
  } else {
    res.status(401).send('Signature mismatch');
  }
});

Python / Flask

import hmac, hashlib, json

def verify(payload, signature, secret):
    expected = f"sha256={hmac.new(
        secret.encode(), payload, hashlib.sha256
    ).hexdigest()}"
    return hmac.compare_digest(expected, signature)

Troubleshooting

4xx/5xx Responses: We retry with exponential backoff. Ensure idempotency.
Timeouts: Endpoints must respond within 5s. Offload heavy processing to queues.
Signature Mismatch: Verify you're using the raw request body, not a parsed object, for HMAC calculation.