Skip to main content

Jama Connect Interchange Help

Validate signed webhook events (admin)

Jama Connect Interchange signs ordinary webhook events after the webhook URL is verified.

Read the following request headers:

  • X-DS-Message-Id

  • X-DS-Timestamp

  • X-DS-Nonce

  • X-DS-Body-SHA256

  • X-DS-Signature

To validate each event:

  1. Preserve the raw request-body bytes before parsing the JSON.

  2. Compute SHA-256 over the raw request body.

  3. Compare the computed value with X-DS-Body-SHA256. Reject the request if the values don’t match.

  4. Construct the signing input in this order:

    1. HTTPS method

    2. Request path

    3. X-DS-Timestamp

    4. X-DS-Nonce

    5. X-DS-Message-Id

    6. X-DS-Body-SHA256

  5. Compute HMAC-SHA256 over the signing input using the stored signature key.

  6. Compare the computed signature with X-DS-Signature. Reject the request if the signatures don’t match.

  7. Process the webhook event after all validation succeeds.

Important

Parse the request body only after you compute its hash. Parsing and reserializing the JSON can change the original bytes and cause validation to fail.

In this section: