Webhook Security

Security

To ensure that the transmission of the information to your public endpoints comes from A-Cube, you can:

Configure a secret token

Configure a secret token in the event destination resource to ensure that the requests sent to your endpoints are authenticated.

• Choose authType = query to ask A-Cube to send the token as a query parameter.
• Choose authType = header to ask A-Cube to send the token as a header.
• Configure the token key authKey and the token value authToken in the event destination resource.

Examples

• In case you chose header as authType, X-Token as authKey and mysecret as authToken, A-Cube will send the token in the header X-Token: mysecret
• While in case you chose query as authType, token as authKey and mysecret as authToken, A-Cube will send the token in the query parameter ?token=mysecret

1. Securing a new webhook

POST /event-destinations

{
  "event": "legal_entity.synchronized",
  "target": "https://your-domain.example/webhook",
  "delivery": "webhook",
  "authType": "header",
  "authKey": "X-Auth",
  "authToken": "asdfghjk"
}

2. Or securing an existing webhook

PUT /event-destinations/{eventId}

{
  "authType": "header",
  "authKey": "X-Auth",
  "authToken": "asdfghjk"
}

For both actions the response will look like:

{
  "eventId": "019ffeec-b9a7-7d3d-abac-2be663ec3de6",
  "event": "legal_entity.synchronized",
  "delivery": "webhook",
  "target": "https://your-domain.example/webhook",
  "authType": "header",
  "authKey": "X-Auth",
  "authToken": "asdfghjk",
  "createdAt": "2026-08-14T06:19:14+00:00",
  "updatedAt": "2026-08-14T06:19:14+00:00"
}