Webhooks do's and dont's: what we learned after integrating +100 APIs - Giuliano Iacobelli - Codemotion Rome 2017
•
1 like•489 views
Le applicazioni moderne sono sempre più orientate ad essere una composizione di API e ad avere un architettura serverless, per questo motivo chi sviluppa API non può limitarsi ad esporre i più comuni endpoint REST. I Webhook non possono mancare in un' API moderna ma non c'è nulla nella letteratura delle API HTTP che si avvicini ad un formato standard per la loro progettazione dando vita alle implementazioni più disparate. Dopo aver integrato oltre 100 API con Stamplay vi raccontiamo quali sono i pro e i contro delle scelte progettuali che si fanno nello sviluppo di Webhook.
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Webhooks do's and dont's: what we learned after integrating +100 APIs - Giuliano Iacobelli - Codemotion Rome 2017
Similar to Webhooks do's and dont's: what we learned after integrating +100 APIs - Giuliano Iacobelli - Codemotion Rome 2017 (20)
More from Codemotion
More from Codemotion (20)
Recently uploaded
Recently uploaded (20)
Webhooks do's and dont's: what we learned after integrating +100 APIs - Giuliano Iacobelli - Codemotion Rome 2017
- 1. Giuliano Iacobelli, Stamplay g@stamplay.com Webhooks do’s and dont’s: what we learned integrating +100 APIs
- 3. g@stamplay.com Lego for APIs Stamplay is a low-code platform that provides a visual interface to drag&drop connectors and creates integration workflows between services
- 4. g@stamplay.com Token based Auth (e.g OAuth2) Machine readable docs (Swagger, RAML, IO docs) Webhooks HATEOAS Key requirements for APIs in the automation era Simple, consistent, flexible, friendly, explorable via URL and use web standards where they make sense.
- 5. g@stamplay.com Key requirements for APIs in the automation era Simple, consistent, flexible, friendly, explorable via URL and use web standards where they make sense. Token based Auth (e.g OAuth2) Machine readable docs (Swagger, RAML, IO docs) Webhooks HATEOAS
- 10. g@stamplay.com
- 11. g@stamplay.com
- 12. g@stamplay.com Consumer sets up a server to listen for webhooks Consumer registers webhook URL with provider Provider starts making request to webhook URL when event happens Webhook Setup
- 13. g@stamplay.com Consumer sets up a server to listen for webhooks Consumer registers webhook URL with provider Provider starts making request to webhook URL when event happens Webhook Setup
- 14. g@stamplay.com Consumer sets up a server to listen for webhooks Consumer registers webhook URL with provider Provider starts making request to webhook URL when event happens Webhook Setup
- 15. g@stamplay.com Webhook anatomy Webhooks are fundamental pieces of an API today and a simple notification is no longer enough, as an API provider you need to do the heavy lifting for your users • a verb: POST • an explicit event type: which could be subscribed by any user (for Github: pull_request, fork, commit, issues, etc.. ) • a payload: containing the relevant data for the related event • including: the resource itself, the sender (user who triggered the webhook) • constant data structure • a security hash: to ensure webhook was delivered by the rightful authority • for Github: sharing a common secret used to generate a hash from the payload • an ID
- 16. g@stamplay.com Fat payload vs Thin payload Provide as much information as possible about the event that is being notified, as well as additional information for the client to act upon that event.
- 17. g@stamplay.com Batch vs Single Services providing high frequency / volume of data might opt to make less calls and batch data into an array
- 18. g@stamplay.com Subscribing to events using multiple URLs Webhooks are fundamental pieces of an API today and a simple notification is no longer enough, as an API provider you need to do the heavy lifting for your users • a CRUD API • a payload URL: the server endpoint that will receive the webhook payload • events list: which events would you like to subscribe to • (optional) the content type
- 19. g@stamplay.com Subscribing to multiple events to single URL Webhooks are fundamental pieces of an API today and a simple notification is no longer enough, as an API provider you need to do the heavy lifting for your users
- 20. g@stamplay.com Fine grained control on events you want to listen on Webhooks are fundamental pieces of an API today and a simple notification is no longer enough, as an API provider you need to do the heavy lifting for your users
- 21. g@stamplay.com Renewing subscriptions Avoid sending webhooks to endpoints that are no longer active by implementing a subscription renewal logic
- 22. g@stamplay.com API for Webhooks aka REST Hooks Webhooks are fundamental pieces of an API today and a simple notification is no longer enough, as an API provider you need to do the heavy lifting for your users
- 23. g@stamplay.com Securing Webhooks Webhooks are fundamental pieces of an API today and a simple notification is no longer enough, as an API provider you need to do the heavy lifting for your users
- 24. g@stamplay.com Webhooks debugging Receives HTTP requests and captures the data for later inspection
- 25. g@stamplay.com Webhooks toolkit: Ngrok Secure introspectable tunnels to localhost
- 26. g@stamplay.com