Webhooks

You can setup multiple webhooks for your organization that subscribe to events.

If you are interested in platform webhook events. Check the docs here.

Organization Events

FEDERATED_GRAPH_SCHEMA_UPDATED

Triggered when the federated graph schema has been updated.

• federated_graph: An object representing the federated graph details.

  • id: The unique identifier for the federated graph.

  • name: The name of the federated graph.

  • namespace: The namespace of the federated graph

• errors: A boolean value indicating whether there were errors during the update.

• actor_id (optional): The identifier of the actor updating the schema.

Sample Payload:

{
  "version": 1,
  "event": "FEDERATED_GRAPH_SCHEMA_UPDATED",
  "payload": {
    "federated_graph": {
      "id": "graph123",
      "name": "MainGraph",
      "namespace": "default"
    },
    "errors": false,
    "actor_id": "user5678"
  }
}

Verification

To ensure the webhook data is coming from a trusted source and hasn’t been tampered with during transit, we employ HMAC signatures. When setting up a webhook, you provide a secret. This secret is used to compute a signature that is sent along with each webhook request.

The header containing this signature is X-Cosmo-Signature-256.

Verification Example

To verify the webhook request, you need to compute the HMAC signature on your server and compare it to the signature in the X-Cosmo-Signature-256 header.

Here’s an example in Node.js:

import crypto from 'crypto';

function verifySignature(body, receivedSignature, secret) {
  const computedSignature = crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex');

  return computedSignature === receivedSignature;
}

// Usage:
const isVerified = verifySignature(JSON.stringify(req.body), req.headers['x-cosmo-signature-256'], YOUR_SECRET);

How to set up Webhook notifications

1. Navigate to the notifications page on Cosmo
2. In the Webhooks tab, click on the Create button.

   
3. Provide the endpoint of the webhook, and the webhook secret for verification and then select the events you want to be notified of.

   
4. Lastly, click on the Create button.