Configure webhooks

A simple authentication method, where the client sends a username and password encoded as a Base64 string in the HTTP request's Authorization header. The server decodes these credentials and verifies them against its user database to grant or deny access.

Enter a username and password.

Fill out the following fields:

• API key: (Bring-your-own-key) Use a password manager or command-line tool to generate a strong random string. This will serve as your API key. Enter the API key you previously generated. The API key is used to identify the traffic coming from the Level Access Platform and to validate it to the destination URL. That is, the webhook API Key allows you to validate and allow Level Access to write to the Webhook URL.
• API Header: The API Key is delivered through a HTTP header. Configure the name of the header you expect to receive this API key in.

Example:

POST /webhook-endpoint HTTP/1.1
Host: api.example.com
API-Key: abc123XYZ789secureTOKEN456
Content-Type: application/json

Example payload:
{
"_id": "686be7568f19d58af3952b28",
"scan": "686be7568e3104bba902d0b5",
"date": "Wed Jul 04 2007 17:56:51 GMT-0700 (Pacific Daylight Time)"
}

The Hash-based Message Authentication Code (HMAC) is a cryptographic technique that combines a hash function and a secret key. The API client does not need to send the actual secret, which serves as a protection against sniffing-related attacks. 

Fill out the following fields: 

• Shared secret:
  Required password used to sign the webhook. We enforce the following minimum length and complexity rules for the password:
  • Length >= 32
  • Has at least one upper case character
  • Has at least one lower case character
  • Has at least one number
  • Has at least one special character
• Signature header name: 
  The name of the HTTP header that transmits a cryptographic signature generated using the HMAC algorithm. The signature allows the receiving server to verify the authenticity of the request (it came from a trusted source), and the integrity of the request (it hasn’t been tampered with). Example: X-Signature: <HMAC-Signature-Value> 
• Timestamp header name: 
  The name of the HTTP header that includes the timestamp of when the request was generated. Helps prevent replay attacks by ensuring the request is recent and hasn’t been reused. Example: X-Timestamp: 2025-06-18T17:10:00Z 

Example: 

POST /webhook-endpoint HTTP/1.1
Host: api.example.com
Content-Type: application/json
X-Timestamp: 1750450042000
X-Signature: 9f2c4a7e8d3b1a6c9e2f...
Example payload: {
"_id": "686be7568f19d58af3952b28",
"scan": "686be7568e3104bba902d0b5",
"date": "Wed Jul 04 2007 17:56:51 GMT-0700 (Pacific Daylight Time)"
}

Note: Request body uses canonical JSON format. To ensure consistent signature generation, the platform canonicalizes the JSON request body using JCS (RFS 8785) before signing. You must apply the same canonicalization process before validating the signature on your end.