Clients should follow the guidelines below when integrating with UMM Services Webhooks.

Example

Incoming JSON (includes a field that may be added in a future release):

{
  "id": "pay_123",
  "status": "completed",
  "new_field_added_later": "xyz"
}

Parsed object with 'ignore unknown properties' enabled (new_field_added_later is discarded; parsing succeeds):

{
  "id": "pay_123",
  "status": "completed"
}

UMM Services Event posting supports different authentication schemes.

In this authentication scheme, UMM Services would send API Keys, in the form of HTTP headers, as part of the webhook. These API Keys must be configured in UMM Services by the client. A client can specify upto a maximum of 5 API keys to be sent in a webhook. The client can check for the authenticity of the webhook by comparing the API keys and values received in the webhook with the ones configured in UMM Services.

Example :

test_header1:value1
test_header2:value2
test_header3:value3
test_header4:value4
test_header5:value5

With Basic Authentication, UMM Services sends a Base64-encoded string that contains the user name and password for the client in the Authorization header of the HTTP request. The client must configure the username and password for the basic authentication in UMM Services. The client can check for the authenticity of the webhook by verifying the username and password received in the webhook with the ones configured in UMM Services. Please note that Base64 is not a form of encryption and is similar to sending the user name and password in clear text.

Example :

Below  dXNlcm5hbWU6cGFzc3dvcmQ=   refers to Base64 encoded string of the provided username and password ( username:password )
(  : ( colon ) is appended in-between username and password before it is being encoded)
Authorization:Basic dXNlcm5hbWU6cGFzc3dvcmQ=

UMM Services supports Open Authorization Protocol 2.0 with Auth scheme as “Bearer”. The client/biller needs to run an authorization server at its end. The client needs to configure the client id, the client secret, the token endpoint (URL) and the Auth scope in UMM Services. The Grant Type to be used is "client_credentials". UMM Services sends the token read from the token endpoint in the Authorization header of the webhook.

Example :

Below 4484e52dc4744374aced826a4543cd28948816ff   refers to the access token issued by Autherization server.
Authorization:Bearer 4484e52dc4744374aced826a4543cd28948816ff

Every webhook request will include the following headers