Skip to main content

Registering Webhooks

Before receiving webhook calls a webhook URL must be registered using the Webhook API Endpoint.

Webhook Structure

Webhooks across the Nmbr API follow a consistent JSON structure that includes:
  • the event
  • the resource
    • type
    • identifier
    • external reference (external_ref), if the resource type supports setting an external reference
    • company identifier, if the resource type is scoped to a company
The webhook call made when a business entity is created would have the following properties:
The webhook call made when a company is created would have similar properties:
Note that the call doesn’t include the company_id property because the resource is the company itself and so its identifier is in the id property. The webhook structure does not contain additional entity data. It is recommended the receiving system performs a GET request for the specific entity to retrieve the most up-to-date resource.

Webhook Security

Nmbr will automatically generate a key for each webhook created. Any outgoing webhook calls will include a Webhook-Signature header with an HMAC SHA256 hash of the payload using the webhook key. Consumers may calculate their own signature using the known key and payload to compare to the request header. If the resulting signatures match the developer can be confident the request came from Nmbr.

Webhook Events

Most resources support 3 standard events:
  • resource_created
  • resource_updated
  • resource_deleted
Some resources have additional events that can be used to determine the state of the resource:
  • payroll_approved
The following table outlines each resource and the corresponding supported events.