Webhooks

Register an address on your server once. Each time a supplier replies to one of your requests for quote, one cannot be delivered, or one of your searches or comparisons ends, we send that address a signed event naming the request for quote, the search or the comparison. Read the details with GET /v1/rfq/{id}, GET /v1/search/{id} or GET /v1/compare/{id}.

Register an endpoint

import os

import requests

response = requests.post(
    "https://api.partfinder.dev/v1/webhooks",
    headers={"Authorization": f"Bearer {os.environ['PARTFINDER_API_KEY']}"},
    json={"url": "https://api.example.com/hooks/partfinder"},
)
print(response.json())

const response = await fetch("https://api.partfinder.dev/v1/webhooks", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PARTFINDER_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ url: "https://api.example.com/hooks/partfinder" }),
});
console.log(await response.json());

curl https://api.partfinder.dev/v1/webhooks \
  -X POST \
  -H "Authorization: Bearer $PARTFINDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://api.example.com/hooks/partfinder"}'

The response carries the endpoint’s signing secret, the only time it is shown. Store it with your other secrets. The address must be https:// and on the public internet. GET /v1/webhooks lists your endpoints, never their secrets, and DELETE /v1/webhooks/{id} stops sending to one.

Who receives what

An endpoint registered with one of your organization’s own keys receives every event of your organization.
An endpoint registered with a key you created for one of your customers (Serving your own customers) receives only that customer’s events. Each event carries the customer’s end_customer_id.

Check every event

Every event is signed in the Standard Webhooks format, with the headers webhook-id, webhook-timestamp and webhook-signature. Check the signature with your endpoint’s secret before trusting the body; the Standard Webhooks libraries do it in one call:

import os

from standardwebhooks import Webhook

wh = Webhook(os.environ["PARTFINDER_WEBHOOK_SECRET"])
# raw_body: the request body exactly as received, before any JSON parsing.
event = wh.verify(raw_body, request.headers)

import { Webhook } from "standardwebhooks";

const wh = new Webhook(process.env.PARTFINDER_WEBHOOK_SECRET);
// rawBody: the request body exactly as received, before any JSON parsing.
const event = wh.verify(rawBody, request.headers);

A call that throws means the event did not come from us, was changed, or is too old: answer 400 and ignore it.

Rotating a signing secret

To replace an endpoint’s secret without missing an event:

Register the same address again with POST /v1/webhooks, using the same key as before, so the new endpoint receives the same events. Store the new secret it returns.
Accept an event signed with either secret. While both endpoints exist, each event is sent to both, with the same webhook-id: ignore the repeat as you would any other.
Once your server checks events with the new secret, delete the old endpoint with DELETE /v1/webhooks/{id}. Its ID is in GET /v1/webhooks. Any delivery still being retried to the old endpoint stops.

Answer quickly, and expect repeats

Answer with any 2xx within 15 seconds. Do the work afterwards; the event only names the request for quote, the search or the comparison.
Anything else, or no answer, is retried, over about three days.
An event can arrive more than once. webhook-id is the same on every attempt: use it to ignore a repeat.

When deliveries fail

The console’s Webhooks page shows each delivery’s status and your server’s Last answer. See Console.

Last answer	What happened	What to do
No answer	Your server did not answer within 15 seconds, or could not be reached.	Check that it is up and reachable from the public internet over HTTPS.
`3xx`	Your server redirected the request. Redirects are not followed.	Register the final address.
`4xx`	Your server refused the request.	Check the path, and that it accepts `POST` and our signature.
`5xx`	Your server returned an error.	Check its logs.

The four events and their fields are in the API reference.

Get Started

Core Concepts

Guides

Integrations

Register an endpoint

Who receives what

Check every event

Rotating a signing secret

Answer quickly, and expect repeats

When deliveries fail

​Register an endpoint

​Who receives what

​Check every event

​Rotating a signing secret

​Answer quickly, and expect repeats

​When deliveries fail

Register an endpoint

Who receives what

Check every event

Rotating a signing secret

Answer quickly, and expect repeats

When deliveries fail