exact-online-webhooks

Exact Online Webhooks

When to Use This Skill

• How do I receive Exact Online webhooks?
• How do I verify the Exact Online HashCode signature?
• Why is my Exact Online webhook signature verification failing?
• How do I subscribe to a topic with the WebhookSubscriptions endpoint?
• How do I handle Accounts, Items, StockPositions, FinancialTransactions, GoodsDeliveries, or Contacts events?
• Why does my Exact Online webhook payload only contain a Key (GUID) and not the full record?

How Exact Online Webhooks Work (Read This First)

Exact Online does not use the Standard Webhooks spec, and the signature is not an HTTP header. Instead, the POST body is:

{
  "Content": {
    "Topic": "Accounts",
    "Action": "Update",
    "Key": "d4d4c8b6-1a2b-4c3d-9e8f-1234567890ab",
    "Division": 123456,
    "ClientId": "0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d"
  },
  "HashCode": "5A3F9C2E7B1D8A46F0C3E9B2D7A15C8E4F6091A2B3C4D5E6F7089ABCDEF01234"
}

Two consequences drive everything below:

1. The signature is the HashCode body field. You verify by re-computing an HMAC-SHA256 over the raw JSON of the Content node and comparing to HashCode.
2. The payload is thin. Content carries only Topic, Action, Key (the entity GUID), Division, and ClientId. To act on the change you fetch the full record from the REST API using the Key and Division.

Exact Online ──POST {"Content":{…},"HashCode":"…"}──▶ your endpoint
                                                        │  verify HashCode
                                                        ▼
                              GET /api/v1/{Division}/{entity}?$filter=ID eq guid'{Key}'
                                                        │  (OAuth2 bearer)
                                                        ▼
                                          read full record → act → return 200

Verification (core)

Compute HMAC-SHA256 over the exact raw JSON substring of the Content node (the characters between {"Content": and ,"HashCode": in the raw body — braces included). Key it with your app's Webhook secret (from the Exact App Center), hex-encode, uppercase, and compare to HashCode. Do not re-serialize the parsed Content object — key order/whitespace would differ and break the hash.