Skip to main content

Inbound Webhooks

Receive events from external systems in real time. When a payment is processed in Stripe or a commit is pushed to GitHub, webhooks deliver the event to SchemaBounce instantly.

Real-Time Push Events

Unlike SaaS connectors that poll on a schedule, webhooks push events as they occur. Delivery lands within 1 to 5 seconds of the change in the source app.

Supported Webhook Sources​

PlatformEvent TypesSignature Header
Stripepayment_intent.*, charge.*, customer.*Stripe-Signature
GitHubpush, pull_request, issues, releaseX-Hub-Signature-256
Shopifyorders/*, products/*, customers/*X-Shopify-Hmac-SHA256
HubSpotcontact.*, deal.*, company.*X-HubSpot-Signature-v3
SalesforceOutbound Messages, Platform EventsX-Salesforce-Signature
Zendeskticket.*, user.*, organization.*X-Zendesk-Webhook-Signature
Slackmessage.*, reaction.*, file.*X-Slack-Signature
Intercomconversation.*, user.*, contact.*X-Hub-Signature
Twiliomessage.*, call.*, recording.*X-Twilio-Signature
SendGriddelivered, opened, clicked, bouncedX-Twilio-Email-Event-Webhook-Signature

Webhook URL Format​

Each webhook source has a unique URL that you configure in the external platform:

https://stream.schemabounce.com/webhooks/{connector}/{token}

Examples:
https://stream.schemabounce.com/webhooks/stripe/wht_abc123xyz
https://stream.schemabounce.com/webhooks/github/wht_def456uvw
https://stream.schemabounce.com/webhooks/shopify/wht_ghi789rst
note

Webhook tokens are created in your workspace settings. Each token identifies your workspace and can be revoked at any time.

Event Payload Format​

Single Event​

{
  "id": "evt_unique_id",
  "type": "insert",
  "source_id": "stripe_prod",
  "source_type": "webhook",
  "object_type": "payment_intent",
  "timestamp": "2024-01-15T10:30:00Z",
  "data": {
    "id": "pi_123abc",
    "amount": 2000,
    "currency": "usd",
    "status": "succeeded"
  },
  "metadata": {
    "webhook_id": "we_xyz789"
  }
}

Batch Events (up to 1000)​

{
  "events": [
    { "id": "evt_1", "type": "insert", "...": "..." },
    { "id": "evt_2", "type": "update", "...": "..." }
  ]
}

Security and Signature Validation​

SchemaBounce validates webhook signatures to make sure events are authentic and haven't been tampered with in transit.

HMAC-SHA256 validation: each platform signs webhooks with a shared secret. SchemaBounce recomputes the signature and compares it using constant-time comparison.

Replay protection: the X-Webhook-Timestamp header is validated to be within 5 minutes, preventing replay attacks with old payloads.

Python Signature Verification Example​

import hmac
import hashlib

def verify_webhook(payload: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode(),
        payload,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(f"sha256={expected}", signature)

Rate Limits by Plan​

PlanRequests/secEvents/requestMax Payload
Starter1001001 MB
Team5005005 MB
Scale2,0001,00010 MB
EnterpriseCustomCustomCustom

Response Codes​

CodeStatusMeaning
202AcceptedEvent(s) accepted and queued for processing
400Bad RequestInvalid payload format
401UnauthorizedInvalid API key or signature
404Not FoundRoute ID not found or paused
429Rate LimitedToo many requests, retry with backoff
503Service UnavailableEvent processing temporarily unavailable

Best Practices​

  • Use batch endpoints: send multiple events per request to reduce overhead.
  • Implement retries: use exponential backoff for 429 and 503 responses.
  • Include idempotency keys: add event IDs to prevent duplicate processing.
  • Rotate secrets regularly: update webhook secrets every 90 days.
  • Monitor webhook health: track delivery success rates and latency.