Subscribe and verify

Subscribe to webhooks

Please contact us to register the URL at which you'd like to receive our webhook requests. Once registered, we recommend managing it in the Developer Portal, where you can view and edit your webhook URL and send test webhooks. You can also change it with Update Webhook URL.

You receive every event type by default except Renewal Solicitation Open, which we turn on when your partner is enrolled in renewal webhooks. To receive only some of them, choose your events in the Developer Portal. See Event subscriptions.

Each webhook request payload is a JSON object containing: data associated with the event, and the event's metadata (i.e. a description of the event and when it was created).

Request payload format

{  "data": JSON Object,  "timestamp": Unix Timestamp,  "type": String}

Every event's data includes a brokerageId identifying the brokerage the event belongs to.

Verify webhooks were sent by Corvus

All Corvus webhook requests include a timestamp and base64-encoded signature in the X-CrowBar-Signature header. The header is comma-separated, with the timestamp prefixed with t= and the signature prefixed with s=.

X-CrowBar-Signature: t=1601414395,s=wGpXVnQVScPh5n7nS63z4MBSc6kCQuefjGNvJy86Fzw=

To verify that a request originated from Corvus:

1. Extract the signature (everything after the s=) from the X-CrowBar-Signature header.
2. Compute an HMAC with the SHA256 hash function, using your API key as the key and the webhook request's body as the message.
3. Compare the signature you've just calculated with the signature in the header. If they match, the webhook is from Corvus.