Skip to main content

Legal

Tax & Accounting

Trade & Supply

Risk & Fraud

News & Media

Books

Developers

Events

Webhook endpoint overview

A webhook (also called a web callback or HTTP push API) is a way for the API to give customer applications near real time information. A webhook sends data as it happens, meaning you get data immediately.
Webhooks are unlike typical APIs, where you have to poll for data often to see changes. This makes webhooks much more efficient for both the publisher and subscriber by simplifying development work, cutting down on the number of API requests, and decreasing the network and processing demand.

Webhook endpoint

To receive events from API Administration, you'll need to implement an HTTPS endpoint.
To add an endpoint:
  • Use the POST method for the endpoint to accept events.
  • If accepted, the event returns a 200 OK HTTP status code.
  • All other HTTP codes signify an endpoint error, and try to publish each webhook event up to 3 times before considering the event lost.
  • Endpoint accepts HEARTBEAT and Test messages without any special actions.

Webhook endpoint security

Use the HTTPS protocol when implementing a callback endpoint to encrypt all communication traffic between the event publisher and the callback. The system automatically adds an authorization header to all requests with a signed JWT Bearer token.
To validate a token signature, download a public certificate key from the following endpoints:
Certificate key
Region
URL
AMER
https://amer.api.transit-hub.thomsonreuters.com/webhooks/certificate/public
APAC
https://emea.api.transit-hub.thomsonreuters.com/webhooks/certificate/public
EMEA
https://apac.api.transit-hub.thomsonreuters.com/webhooks/certificate/public
The system can cache a certificate public key to improve overall performance for up to 10 minutes.

Code example for token validation (C# nuget package)

Example code
/// <summary>
/// Check if the JWT signature is valid.
/// </summary>
/// <param name="token">JWT sent with request.</param>
/// <param name="publicKey">Public key for signature validation.</param>
/// <param name="cancellationToken">Cancellation token.</param>
/// <returns>Is token valid</returns>
public async Task<bool> ValidateJwtSignature(string token, byte[] publicKey, CancellationToken cancellationToken)
{
var jwtHandler = new JwtSecurityTokenHandler();
var jwt = jwtHandler.ReadJwtToken(token);

try
{
   using (var rsa = RSA.Create())
   {
     rsa.ImportRSAPublicKey(publicKey, out _);

     var validationParameters = new TokenValidationParameters
     {
       ValidateAudience = false,
       ValidateIssuer = false,
       ValidateIssuerSigningKey = true,
       IssuerSigningKey = new RsaSecurityKey(rsa),
       CryptoProviderFactory = new CryptoProviderFactory
       {
         CacheSignatureProviders = false
       }
   };

   SecurityToken validatedToken;
   jwtHandler.ValidateToken(jwt.RawData, validationParameters, out validatedToken);

   return true;
}
}
catch (SecurityTokenExpiredException)
{
 return false;
}
catch (Exception)
{
 return false;
}
}

VPC enhancements

The new VPC enhancements enable Events to use dedicated gateways for internet connectivity through VPC. This facilitates the transmission of events to you while improving security and performance.
If you configured any specific internet addresses in your applications or security rules that restrict access using IPs, you'll need to update them. Our change reduces the number of IPs that you need to add to your allowlist, where your application only accepts from limited IPs.
Refer to the following list of IPs.
AMERs
  • 20.81.168.101
  • 20.151.232.150
  • 20.46.225.27
  • 52.229.67.149
  • 13.91.17.178
  • 20.84.80.196
EMEA
  • 20.77.247.218
  • 20.68.249.137
  • 51.105.243.233
  • 40.113.40.7
  • 51.116.82.110
  • 51.116.103.39
APAC
  • 52.243.99.13
  • 20.70.178.233
  • 104.43.57.11
UAT
  • 20.81.168.101
  • 20.151.232.150
  • 20.46.225.27
  • 52.229.67.149
  • 13.91.17.178
  • 20.84.80.196
  • 20.57.26.238
  • 52.232.135.109
  • 168.61.74.7
  • 20.46.235.3
  • 20.115.50.218

This article applies to:

  • PRODUCT: ONESOURCE API Administration