Webhooks

The Tremendous API supports a callback system allowing you to react to the various events that happen within your organization's account.

The system uses webhooks to send notifications to one of your servers over HTTPS.

List of available events

Webhook setup

Every organization can set up a single endpoint to where we will send webhook requests. You can configure that receiving endpoint (e.g. its URL) via the API. See the API reference for the webhook endpoints.

Webhook requests

Webhooks will be sent as HTTP POST requests. The request body is a JSON document that looks like this:

{
  "event": "CAMPAIGNS.CREATED",
  "uuid": "5ccc7bb1-7659-4e23-a407-77d8cd9c62f5",
  "created_utc": "2021-04-06T20:05:01.037-04:00",
  "payload": {
    "resource": {
      "id": "2V3PCCL7QXDA",
      "type": "campaigns"
    },
    "meta": {
    }
  }
}

Request properties

Responding to webhooks / errors & retries

The endpoint that receives webhooks from our system must respond with a 200 HTTP response code. If it fails to do so, the same webhook will be retried up to 17 times, with an exponential delay (backoff) between attempts.

Please make sure to check the webhook's uuid field on every webhook to ensure you are not reacting to the same event multiple times.

Webhook IPs

All webhook requests are originated from the following IP addresses:

# Production
34.150.143.187
34.86.45.235
35.188.236.188
34.150.208.194

# Sandbox
35.194.78.88
34.150.132.8
34.145.182.28
35.221.12.21

Webhook verification

To verify that the webhook sent to your receiver originates from Tremendous, every request is signed. You can find the signature in a HTTP request header named Tremendous-Webhook-Signature. The header's value is always a prefix (sha256=), followed by the actual signature.

The signature is signing the whole request body using HMAC-SHA256 in a hexadecimal representation.

You can obtain the private key used for the signature during the configuration of your webhook endpoint. It will be returned in the API response when you create the webhook or when you retrieve a webhook through the API.

Verification example (Ruby):

def request_valid?(private_key:, request:)
  signature_header = request.headers['Tremendous-Webhook-Signature']
  algorithm, received_signature = signature_header.split('=', 2)

  expected_signature = OpenSSL::HMAC.hexdigest(
    OpenSSL::Digest.new('sha256'), private_key, request.body.read
  )

  received_signature == expected_signature
end

Multiple webhook receiver

If you need to receive webhooks to multiple endpoints:

1. Setup a central receiving endpoint on your side
2. Let that receiver fan out notifications to other parts of your infrastructure