Why Do I Need A Webhook?

Once one of your users successfully finishes an Authentication, you will need to wait for Passbase to process the provided Document. Once finished, you can request the result of that Authentication (e.g. date of birth or first name). But when is the right time to request the details from Passbase? This is where a webhook comes in place. We can notify you once we have finished the processing the Document. Therefore you know now is the right time to send us the request.

Configuration

In order to properly setup a webhook, your server should provide an endpoint supporting:

• TLS encryption version 1.2

• POST requests as raw in text/plain or application/json format

You can use a service like e.g. https://webhook.site/ to try out and receive webhooks from your dashboard. We can schedule a call with you and help you set everything up. Just join our developer slack and reach out to us.

Events

Our webhook service supports two events, which describe the status of the Authentication once it has been processed by our system:

• AUTHENTICATION_PROCESSED:The Authentication has been processed and is ready to be reviewed in your dashboard

• AUTHENTICATION_REVIEW_STATUS_CHANGED:The Authentication has been approved or rejected in your dashboard. This can directly by triggered if you are using our auto accept / reject feature based on a threshold.

Security

Webhooks are crucial node to ensure the functionality of the Passbase integration and, as such, they can be the target of a malicious user aiming to disrupt the service or impersonate your users. In order to protect your application from these threats you must include a 32 bytes (or ASCII characters) long secret in your webhook configuration, which will be used to encrypt the request body.

You'll find examples below on how to decipher the incoming webhook request. We assume the variable request_body to be coming from your backend framework. The cipher initialization vector will be sent over in the first 16 bytes of the response.

const crypto = require("crypto")
​
const request_body = "" // Your response from the webhook
const encrypted_result = Buffer.from(request_body, 'base64')
​
const iv = encrypted_result.slice(0,16)
const cipher = crypto.createDecipheriv('aes-256-cbc', "YOUR_WEBHOOK_SECRET", iv)
​
const decrypted_result_bytes = Buffer.concat([cipher.update(encrypted_result.slice(16)), cipher.final()])
const decrypted_result = decrypted_result_bytes.toString()
​
const json_result = JSON.parse(decrypted_result)

from Crypto.Cipher import AES
import base64
import json
​
request_body = "" # Your response from the webhook
​
encrypted_result = base64.b64decode(request_body)
​
iv = encrypted_result[:16]
cipher = AES.new("YOUR_WEBHOOK_SECRET", AES.MODE_CBC, iv)
​
decrypted_result_bytes = cipher.decrypt(encrypted_result[16:])
decrypted_result = bytes.decode(decrypted_result_bytes)
​
json_result = json.loads(decrypted_result)

require 'openssl'
require 'base64'
​
request_body = "" # Your response from the webhook
​
encrypted_result = Base64.decode64(request_body)
​
cipher = OpenSSL::Cipher::AES256.new(:CBC)
cipher.decrypt
cipher.key = "YOUR_WEBHOOK_SECRET"
cipher.iv = encrypted_result[0..15]
​
decrypted_result = cipher.update(encrypted_result[16..-1]) + cipher.final
​
json_result = JSON.parse(decrypted_result)

// OpenSSL is already integrated in PHP
​
$request_body = ""; // Your response from the webhook
$key = "YOUR_WEBHOOK_SECRET";
​
$encrypted_result = base64_decode($request_body);
​
$iv = substr($encrypted_result, 0, 16);
$decrypted_result = openssl_decrypt(substr($encrypted_result, 16), 'AES-256-CBC', $key, $options=OPENSSL_RAW_DATA, $iv);
​
$json_result = json_decode($decrypted_result, true);

package main
import (
	"crypto/aes"
	"crypto/cipher"
	"encoding/base64"
	"fmt"
)
​
func main() {
	var webhook_response = "" // Your response from the webhook
	key := []byte("YOUR_WEBHOOK_SECRET")
	decrypted_webhook := decrypt(key, webhook_response)
	fmt.Printf(decrypted_webhook)
}
​
func decrypt(key []byte, cryptoText string) string {
  cipherText, err := base64.StdEncoding.DecodeString(cryptoText)
  if err != nil {
		panic(err)
	}
​
	block, err := aes.NewCipher(key)
	if err != nil {
		panic(err)
	}
	
  if len(cipherText) < aes.BlockSize {
		panic("cipherText too short")
	}
	
	iv := cipherText[:aes.BlockSize]
	cipherText = cipherText[aes.BlockSize:]
  mode := cipher.NewCBCDecrypter(block, iv)
	mode.CryptBlocks(cipherText, cipherText)
​
	return fmt.Sprintf("%s", cipherText)
}

Result

Authentication is processed

If you have set up a webhook on Passbase and one of your users completes an Authentication, you will receive a response body like below. The AUTHENTICATION_PROCESSED event means that an Authentication by a user has been completed and waits to be reviewed (accepted or rejected) or will now be automatically accepted / rejected by our automation feature.

{
  "event": "AUTHENTICATION_PROCESSED",
  "authentication_key": "61c9eceb-cf83-44cd-bd5e-d346e55cdc5d",
  "review_status": null,
  "created_at": 1582628711,
  "updated_at": 1582628999,
  "integration_type": "signup",
  "additional_attributes": {
    "identifier": "aofbaofib@gmail.com",
    "country_code": "us",
    "zm_session_id": "asdfa-124-312g-24-23457f39864d",
    "identifier_type": "email",
    "customer_user_id": "1234567"
  },
  "reauthenticated_from_key": null,
  "watchlist": null,
}

Authentication status has changed

This webhook response is fired once an Authentication status has changed. This will happen if the Authentication has been approved or rejected in your dashbaord, or the automation has automatically accepted or rejected based on a threshold set by you (e.g. >90%).

After this event, it is the time to use our API now, to ping the details of this verification with the authentication_key. Please take a look at the API section for this and also compare our best practice implementation.​

{
  "event": "AUTHENTICATION_REVIEW_STATUS_CHANGED",
  "authentication_key": "b5127b6-5e1f-4bl7-9fae-ca8124d18930a",
  "review_status": true,
  "created_at": 1585782482,
  "updated_at": 1585782614,
  "integration_type": "signup",
  "additional_attributes": {
    "identifier": "aofbaofib@gmail.com",
    "country_code": "us",
    "zm_session_id": "asdfa-124-312g-24-23457f39864d",
    "identifier_type": "email",
    "customer_user_id": "1234567"
  },
  "reauthenticated_from_key": null,
  "watchlist": null
}

You can find a further description of the response values below:

Deprecated fields

• api_key: Used in custom authorization protocols

• customer_user_id: Contains specific data from additionalAttributesof an Authentication

• authenticated_at: When the Authentication was either accepted or rejected

• authenticated: Whether the Authentication was accepted or rejected

• reviewed_at: When the Authentication was processed

• authentication_review_status: Same as review_status