Merchant.Webhooks (Merchant v0.6.0)

Provides functions for working with webhooks

Summary

Functions

construct_event(payload, timestamp_header, signature_header, secret, tolerance \\ 300)

Verify webhook payload and return a Merchant event.

create(params)

delete(id)

retrieve(id)

retrieve_list()

rotate_signing_secret(id)

update(id, params)

Types

create_params()

@type create_params() :: %{events: [String.t()], url: String.t()}

update_params()

@type update_params() :: create_params()

Functions

construct_event(payload, timestamp_header, signature_header, secret, tolerance \\ 300)

@spec construct_event(String.t(), String.t(), String.t(), String.t(), integer()) ::
  {:ok, Merchant.WebhookEvent.t()} | {:error, any()}

Verify webhook payload and return a Merchant event.

payload is the raw, unparsed content body sent by Stripe, which can be retrieved with Plug.Conn.read_body/2. Note that Plug.Parsers will read and discard the body, so you must implement a custom body reader if the plug is located earlier in the pipeline.

signature is the value of Revolut-Signature header, which can be fetched with Plug.Conn.get_req_header/2.

secret is your webhook endpoint's secret.

tolerance is the allowed deviation in seconds from the current system time to the timestamp found in signature. Defaults to 300 seconds (5 minutes).

Revolut Merchant API reference: https://developer.revolut.com/docs/guides/accept-payments/tutorials/work-with-webhooks/verify-the-payload-signature

Example

case Merchant.Webhooks.construct_event(payload, timestamp, signature, secret) do
  {:ok, %Merchant.WebhookEvent{} = event} ->
    # Return 200 to Revolut and handle event

  {:error, reason} ->
    # Reject webhook by responding with non-2XX
end