1 - Can webhook Endpoints be different for Sandbox or Production?
Ans - Yes. Both Sandbox and Production are independent environments, hence the webhook account is separate for each.
2 - Can webhook Endpoint be different for each type of Event ?
Ans - Yes.
3 - Will I be notified when my webhooks are failing?
Ans - Yes, Digio makes periodic attempts on non 200 http responses. First email is sent to the registered account email, if the webhook is failing since the last 1 hour. If any failure is observed, subsequent attempts are made after 5 minutes, 10 minutes, 15 minutes, 30 minutes (total 1 hour and first mail is triggered) and post that every 1 hour upto 24 hours. If any success is observed during these attempts, regular flow is restored.
4 - I am not able to identify why my webhook is failing, is there a way to find out what error Digio is receiving while hitting my webhook?
Ans - Yes. When an email notification is sent about webhook failure, it contains HTTP Error code, Error message received and The Entity id (eg. Document id or Mandate id) for which the webhook attempt is continuously failing.
5 - Will I be notified when my webhooks are disabled ?
Ans - Yes, If the webhook endpoint is returning a non 200 response for more than 24 hours, webhook account is disabled and a Webhook disable email is sent to the registered email id. Sample email -
6 - My endpoint is different for each type of webhook and only one type of event is throwing error, will other events also be stopped when webhooks are disabled?
Ans - Yes, the queue is maintained at account level. While endpoints can be different but any failure impacts all types of events.
7 - How do I enable my webhooks back, if it's disabled due to non 200 responses for more than 24 hours?
Ans - Once you fix the issue so that endpoint is returning 200, you can login to Enterprise dashboard and enable it back by pressing “Click to Activate” under webhook section. Refer below image -
8 - How do I get to know when my Webhooks are enabled?
Ans - You’ll receive a Webhook enabled email from Digio to the registered email address. Also you can observe the event processing at your end. Sample email -
9 - For the period my webhooks were disabled, will I still be receiving the old webhook events or events created within this duration when my webhooks are enabled again?
Ans - Yes, webhook events are queued and processed separately when webhook endpoint is working.
10 - How do we make sure that webhook events are coming only from Digio. IP Whitelisting ?
Ans -
- You may allow webhooks only from below IPs:
- Sandbox : 35.154.20.28
- Production : 13.126.198.236
- Provide a secret key and validate. Use X-Digio-Checksum header. On the client side, HmacSHA256 hex string of payload can be generated using the secret key and compared with the checksum provided in X-Digio-Checksum header.
Check below link to calculate HmacSHA256 in your preferred coding language: https://github.com/danharper/hmac-examples
11 - Can Secret Key used for X-Digio-Checksum header be different for each type of event?
Ans - No. Secret key is at account level. Though, Sandbox and Production secret keys can be different as both are independent environments.
12 - I have received 20+ webhook calls for the same webhook event, but none for any other - what does this mean?
Ans - A queue is maintained for each account, event on top is reattempted till a 200 response is received. If your endpoint is not returning a 200 http response you might observe multiple attempts on the same object, till webhooks are disabled or a 200 response is received.
13 - Do I need to provide my IP address to Digio for whitelisting to consume webhooks ?
Ans - No, not required. Webhook endpoint is sufficient.
14 - What is the usual delay for receiving a webhook ?
Ans - On production average time is 5 Seconds. On Sandbox is mainly for functional testing hence it’s 5 Minutes.
15 - My webhook endpoint keeps getting disabled due to various reasons, any best practices should I follow?
Ans - Do not execute business logic while receiving webhooks. Even if you execute, make sure a 200 response is returned always. For example an entity not found in your database (due to data archival), or state change of an object where this webhook is not relevant - Log these cases, catch the errors and always return HTTP 200 to webhook calls.
16 - I recently started using a new Service of Digio, but not receiving webhooks for this one while I am receiving proper webhooks for existing services.
Ans - Webhooks are enabled at event/service level. If you started using a new service, for example you were using NACH mandate registration webhooks, now started using NACH Debits as well you can login to Enterprise Dashboard and enable relevant webhooks.
17 - How much time my API can take, before Digio triggers a http timeout and considers the attempt as failure?
Ans - 10 Seconds.
18 - I want to update my webhook secret key. How can I do that ?
Ans - Go to profile section of Enterprise Dashboard and update the secret key from the webhook section.
19 - I am not able to find out the issue while reading received json? How can I debug ?
Ans - For UAT you may create a temporary public endpoint on websites like https://requestbin.com/, update your webhook endpoint on Digio Enterprise Dashboard (Profile section) and perform a transaction where webhook is triggered. These public endpoint show the received data (Headers and Body) in readable format. Observe received headers and Body and fix the issue in your code.
20 - Any other best practices to follow ?
Ans - Keep the flexibility of retrieving unknown fields with the webhook response. As the platform evolves new fields are introduced time to time. Reading of webhook data should not fail while a new parameter is received. For example in Java you can use below property on your objects : @JsonIgnoreProperties(ignoreUnknown = true)