Skip to main content

Security

By default, Price Edge will not send any kind of data through the web hooks. The reason for that is to ensure that only authorised entities have access to the data. When a request is received, it is the client that needs to request the data using the regular flow. If however you do want to include the data in the request, you can set this when registering the webhook. The receiving service can implement a verification step as Price Edge will include a hashed signature in the request header (X-Priceedge-Webhook-Signature), which uses the shared secret value that was sent when the hook was registered. The signature text is formatted as: "{data.eventTime}.{data.eventId}.{clientSecret}” (data is the body of the request). A sample C# program to check the signature is included bellow. One additional validation the receiving service can implement is only allowing the Price Edge IP (thirty-four.242.194.17) to call the endpoint.