Signed event delivery
Webhooks and Events
Implement signed, replay-safe, idempotent event delivery for authorization, session, credential, policy, licensing, entitlement, incident, and evidence changes.
Production endpoints, credentials, native attestation, cloud integrations, and release certification remain environment-specific.
Working components
C# Webhook VerifierFixed-time HMAC comparison, timestamp validation, and canonical event verification.Open →Postman CollectionIncludes a webhook simulation request.Open →Test ModeExercise duplicate delivery, stale timestamp, and invalid-signature cases.Open →Promotion ChecklistRelease evidence for signing, replay, idempotency, and recovery.Open →
Implementation steps
Register an exact HTTPS receiver and accountable owner.
Verify the signature over the raw body and canonical event fields before parsing business data.
Enforce timestamp freshness and atomic replay protection.
Persist the event identifier and make processing idempotent.
Expose delivery health, retry, replay, disablement, and rotation controls.
Test duplicate, delayed, reordered, malformed, revoked-key, and outage scenarios.
Control details
Signature verification
Use the raw received bytes, assigned algorithm, key identifier, canonical timestamp, event identifier, and fixed-time comparison.
Idempotency
Persist the authoritative event identifier before side effects and return success for safely repeated delivery.
Key rotation
Support overlapping verification keys, explicit activation and retirement, audit, and rapid compromise revocation.
Verify freshness, signature, and idempotency
ASP.NET Core webhook handler excerpt
bool valid = B5WebhookVerifier.Verify(
secret,
eventId: request.Headers["X-B5-Event-Id"],
timestamp: request.Headers["X-B5-Timestamp"],
body,
suppliedSignatureBase64: request.Headers["X-B5-Signature"],
now: DateTimeOffset.UtcNow,
maximumAge: TimeSpan.FromMinutes(5));
if (!valid) return Results.Unauthorized();
if (await eventStore.ExistsAsync(eventId)) return Results.Ok();
await eventStore.ProcessOnceAsync(eventId, body);| Header | Use |
|---|---|
X-B5-Event-Id | Idempotency and audit identity. |
X-B5-Timestamp | Freshness window and replay control. |
X-B5-Signature | HMAC signature over event ID, timestamp, and body digest. |
X-B5-Correlation-Id | Trace the source action and delivery attempts. |
Release boundary: Production endpoints, credentials, native attestation, cloud integrations, and release certification remain environment-specific.
Developer Relations
Talk to a human.
Get architecture guidance, Test Mode access, integration review, or help choosing the right B5 identity and authorization pattern.