- Created by user-5c3b0, last modified by user-e873e on Aug 19, 2020
Learn configure a webhook and receive event notifications from Fusion
Using Fusion webhook APIs, you can set up a webhook against the available Fusion event types. In this tutorial, you learn about how to set up a webhook that can be used to receive an event notification about important business process flows.
For more information on webhook APIs, see Core API Reference.
Configure a webhook
Keep a webhook URL ready that can receive JSON objects and support basic HTTP authentication. Share this endpoint with Zeta. Zeta will register the webhook endpoint in Fusion and share a secret token with you to validate the incoming webhook messages.
Select an Event
Before creating a webhook, let's find out Fusion topics and events that are available for you to configure a webhook. See Fusion Events for a list of topics/events that you can subscribe to.
Add a webhook
Set up your webhook to handle incoming event messages using
/registerWebhookSubscription endpoint. Specify the event details in the body parameter.
To add a webhook against an event, use the following endpoint:
subscriptionID: Required. Unique identifier of the event subscription.
topic: Required. Fintech-specific object to which the event is emitted from a business logic.
webhookURL: Required. Webhook endpoint to handle incoming webhook messages.
secret: Required. Secret token to validate the incoming webhook message. Zeta will share a secret token
Test a webhook
After you have subscribed for an event notification (lets say, a payment and A2A transfer event) , simulate an Ecom, ATM or POS transaction and check the webhook endpoint for any possible notification. The webhook endpoint is the
webhookURL you've configured in the previous step against a payment event/topic (
topic). If you receive a webhook message, proceed to the next step to verify that the incoming message delivered from a secured Fusion endpoint.
Contact Zeta Support to simulate and test a payment webhook.
A2A Transfer Event
A new sample payment event would look something like this after the webhook configuration and subscription. Note the
data objects in the payload below:
A new A2A transfer event would look something like this after the webhook configuration and subscription. Note the
data objects in the payload below:
Validate a webhook
Ensure that you have already shared the webhook endpoint with Zeta. Zeta will register the webhook endpoint in Fusion platform.
You must verify every incoming event to ensure the messages are delivering from a secured Fusion endpoint. Zeta will share a secret token (used in above API call) with you to verify the authenticity of the message. Using the secret token, you can generate an HMAC (Hash-based Message Authentication Code) signature to match with the X-Zeta-HMAC that is passed in the header along with the event message.
To validate a webhook
You can use the
ZetaHmacVerificationUtil class to validate the webhook:
- Extract the raw bytes from the received event body
- Extract the Nonce value from the HTTP header with the key
- Extract the HMAC value from the HTTP header with the key
- Invoke the
verifyZetaHmacfunction of the
ZetaHmacVerificationUtilclass, with the arguments
data(from step 1),
base64EncodedSecret(shared by Zeta),
nonce(from step 2),
hmac(from step 3). The method returns true if the incoming HMAC is equal to the Zeta-computed HMAC, and false otherwise. If the method returns true, you can consider the event message is valid and sent over secured Fusion connection. If it returns false, reject the message and report to Zeta for further analysis.
- Alternatively, you can invoke
ZetaHmacVerificationUtil#computeZetaHmacwith the data from steps 1 and 2, along with the secret token shared by Zeta, to generate the HMAC on your own. Compare the generated HMAC with the extracted HMAC (from step 3). If both are identical, the message is valid and authentic.
Contact Zeta Support to obtain the secret token or any help to validate a payment webhook.
Learn about supported Fusion events.
Learn more about webhook APIs
Know about various payment events and its lifecycle.
- No labels