Webhook

Use the Webhook capability to receive real-time notifications of everything that happens on the API. You only have to set one Webhook URL: all of the notifications will be sent there. With the URL you must also supply a secret, which allows you to identify that the notifications you are receiving are coming from Build. Your Webhook endpoint must be reachable via HTTPS, and return a 200 HTTP response quickly before executing any complex logic that might result in a timeout.

Set up your webhook receiver

Webhook signatures

A webhook signature is a security measure which allows you to verify the integrity and authenticity of the data you’re receiving. Each webhook contains a hash-based message authentication code (HMAC) in its signature header. All you need to do is take the webhook's body and apply the SHA-1 hash function to it, using your secret as the hash key. You then compare the resulting HMAC to the one contained in the signature header. If the HMACs are identical, then the data corresponds to what we sent. If they are different, this indicates that the data has been intercepted and altered in some way.

Automatic retries

When a webhook notification fails, the retry mechanism begins. We automatically try to resend the webhook notification multiple times, following a schedule. Each retry happens after the specified times:

1. 30 secs
2. 60 secs
3. 90 secs
4. 120 secs
5. 150 secs
6. 180 secs

IP address allowlisting

1. Sandbox environment
   • 13.237.90.47
   • 13.210.78.87
   • 54.253.161.136
2. Live environment
   • 52.63.172.6
   • 52.63.244.60
   • 52.65.227.86
   • 52.65.201.21
   • 13.54.136.30
   • 3.104.12.185
   • 3.24.5.91
   • 3.105.126.70

Webhook Catalog

Transaction Notifications