Chilkat Online Tools

DataFlex / New FreshBooks / Verify Webhook Callback

Back to Collection Items

Use ChilkatAx-9.5.0-win32.pkg

Procedure Test
    Handle hoHttp
    Boolean iSuccess
    Handle hoJson
    Variant vSbRequestBody
    Handle hoSbRequestBody
    Variant vResp
    Handle hoResp
    String sTemp1
    Integer iTemp1
    Boolean bTemp1

    // This example assumes the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    Get Create (RefClass(cComChilkatHttp)) To hoHttp
    If (Not(IsComObjectCreated(hoHttp))) Begin
        Send CreateComObject of hoHttp
    End

    // Use this online tool to generate code from sample JSON: Generate Code to Create JSON

    // The following JSON is sent in the request body.

    // {
    //   "callback": {
    //     "callback_id": 123,
    //     "verifier": "{{verifier}}"
    //   }
    // }

    Get Create (RefClass(cComChilkatJsonObject)) To hoJson
    If (Not(IsComObjectCreated(hoJson))) Begin
        Send CreateComObject of hoJson
    End
    Get ComUpdateInt Of hoJson "callback.callback_id" 123 To iSuccess
    Get ComUpdateString Of hoJson "callback.verifier" "{{verifier}}" To iSuccess

    // Adds the "Authorization: Bearer <access_token>" header.
    Set ComAuthToken Of hoHttp To "<access_token>"
    Send ComSetRequestHeader To hoHttp "Content-Type" "application/json"

    Get Create (RefClass(cComChilkatStringBuilder)) To hoSbRequestBody
    If (Not(IsComObjectCreated(hoSbRequestBody))) Begin
        Send CreateComObject of hoSbRequestBody
    End
    Get pvComObject of hoSbRequestBody to vSbRequestBody
    Get ComEmitSb Of hoJson vSbRequestBody To iSuccess

    Get pvComObject of hoSbRequestBody to vSbRequestBody
    Get ComPTextSb Of hoHttp "PUT" "https://api.freshbooks.com/events/account/{{accountId}}/events/callbacks/{{callbackId}}" vSbRequestBody "utf-8" "application/json" False False To vResp
    If (IsComObject(vResp)) Begin
        Get Create (RefClass(cComChilkatHttpResponse)) To hoResp
        Set pvComObject Of hoResp To vResp
    End
    Get ComLastMethodSuccess Of hoHttp To bTemp1
    If (bTemp1 = False) Begin
        Get ComLastErrorText Of hoHttp To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get ComStatusCode Of hoResp To iTemp1
    Showln iTemp1
    Get ComBodyStr Of hoResp To sTemp1
    Showln sTemp1
    Send Destroy of hoResp


End_Procedure

Curl Command

curl -X PUT
	-H "Authorization: Bearer <access_token>"
	-H "Content-Type: application/json"
	-d '{
    "callback": {
        "callback_id": {{callbackId}},
        "verifier": "{{verifier}}"
    }
}'
https://api.freshbooks.com/events/account/{{accountId}}/events/callbacks/{{callbackId}}

Postman Collection Item JSON

{
  "name": "Verify Webhook Callback",
  "request": {
    "method": "PUT",
    "header": [
      {
        "key": "Content-Type",
        "name": "Content-Type",
        "value": "application/json",
        "type": "text"
      }
    ],
    "body": {
      "mode": "raw",
      "raw": "{\n    \"callback\": {\n        \"callback_id\": {{callbackId}},\n        \"verifier\": \"{{verifier}}\"\n    }\n}"
    },
    "url": {
      "raw": "https://api.freshbooks.com/events/account/{{accountId}}/events/callbacks/{{callbackId}}",
      "protocol": "https",
      "host": [
        "api",
        "freshbooks",
        "com"
      ],
      "path": [
        "events",
        "account",
        "{{accountId}}",
        "events",
        "callbacks",
        "{{callbackId}}"
      ]
    },
    "description": "## Verifying Webhooks\n\nEach Webhook sent by FreshBooks includes a header, X-FreshBooks-Hmac-SHA256, with a base64-encoded signature generated using with the data sent in the request and token originally sent in the web hook verification process as a secret.\n\nWhen you receive the webhook, you can verify that it came from FreshBooks by computing the signature and comparing it against the header.\n\nWhen generating your cryptographic hash function, you will have two inputs. \n\n1. Your string input will be the response parameters which you will need to enter as a JSON String. \n\ni.e. `message = '{\"name\": \"client.update\", \"object_id\": \"177864\", \"user_id\": \"1\", \"account_id\": \"K1pdgJ\"}'` \n\n2. Your verifier (or 'secret') is sent as a response from your initial webhook registration. \n\nIt is also important that you maintain spaces between all colons and commas.  \n\nYou will also need to make sure that your verifier is a base64 encoded string. \n\nHere is an example script in Python: \n\n\n```\nimport base64\nimport hmac\nimport hashlib\n\nverifier = \"UWQfd9zCzxmVwFZWKqqKwLxqz8gvzGdAn\"\nmessage = '{\"name\": \"client.update\", \"object_id\": \"177864\", \"user_id\": \"1\", \"account_id\": \"FrEsHb\"}'\ndig = hmac.new(\n    verifier,\n    msg=message,\n    digestmod=hashlib.sha256\n).digest()\nprint(base64.b64encode(dig).decode())\n``` \nand an example in Node.js:\n\n\n```\nconst crypto = require('crypto')\nconst utf8 = require('utf8');\n\nconst hmac = hmac256(utf8.encode('{\"name\": \"client.update\", \"object_id\": \"177864\", \"user_id\": \"1\", \"account_id\": \"FrEsHb\"}'),\n\n  Buffer.from(utf8.encode('UWQfd9zCzxmVwFZWKqqKwLxqz8gvzGdAn')),\n\n  'base64')\n\nconsole.log(hmac)\n\n\n\nfunction hmac256(data, authKey, encoding) {\n\n  const x = crypto.createHmac('sha256', authKey)\n  x.update(data)\n  return x.digest(encoding)\n}\n```\n"
  },
  "response": [
  ]
}