Webhooks

CVN PSA receives webhooks from the services you connect. Each endpoint checks that a request really came from that service before it records anything.

Endpoints

All addresses are on your own domain.

Endpoint	From	How it is checked
`/api/webhooks/payments/stripe`	Stripe	Stripe's signature header, with a five-minute replay window
`/api/webhooks/payments/square`	Square	Square's HMAC-SHA256 signature over the notification URL and body
`/api/webhooks/yeastar`	Yeastar PBX	HMAC-SHA256 of the body with your webhook secret
`/api/webhooks/telnyx`	Telnyx SMS	Telnyx's Ed25519 signature, when you store Telnyx's public key
`/api/webhooks/unifi/{token}`	UniFi Alarm Manager	A random token per site in the address. An unknown token returns 404
`/api/teams/messages`	Microsoft Teams	The signed token Microsoft's Bot Connector sends with each request
`/api/v1/webhooks/netlock`	Your own scripts	An API key with write scope. Older endpoint for pushing RMM device data

Each endpoint is rate-limited.

Payment webhooks

Open Configuration › Payment Providers. The webhook address for each provider is shown on its card.
Add that address in the Stripe or Square dashboard and subscribe to payment events.
Copy the provider's signing secret into the card and save.

With no signing secret saved, every payment webhook is refused. A request with a bad signature is refused and recorded in the audit log. When a payment is confirmed, it is matched to its invoice and recorded with its own receipt number.

Telnyx

Without a public key stored, the Telnyx endpoint still accepts messages, but it is only as private as its address. Store the public key from your Telnyx portal to turn on signature checks.

UniFi

Each UniFi site gets its own webhook address with a token in it. If an address is exposed, rotate the site's token from the UniFi settings and update the address in UniFi. Alarms from a site that is not yet mapped to a client are kept as unassigned alerts.

See Phone, Teams and network for setting up each of these services.