> ## Documentation Index
> Fetch the complete documentation index at: https://docs.awardforce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook payloads

> Payload structure and signature validation for Award Force webhooks.

Webhook payloads are provided in JSON format and always contain the following attributes:

<ParamField header="event" type="string">
  Enumerated string with possible values being one of the events described in the [Available subscriptions](/docs/additional/webhook-subscriptions) page.
</ParamField>

<ParamField header="timestamp" type="string">
  ISO 8601 formatted datetime value, for example `2020-01-01T00:00:00Z`.
</ParamField>

<ParamField header="trigger" type="string">
  Machine-readable event key that fired the webhook. Enumerated string with possible values matching the event codes described in the [Available subscriptions](/docs/additional/webhook-subscriptions) page.
</ParamField>

<ParamField header="source" type="string">
  Enumerated string with the following possible values:

  * `ui` (default)
  * `api`
</ParamField>

### Signature

Use the `Signature` header to validate the webhook payload.

The signature value is generated with this algorithm, using the **Signing key** specified in the webhook and the JSON payload:

<CodeGroup>
  ```php PHP theme={null}
  $signature = hash_hmac('sha256', $payloadJsonString, $signingKey);
  ```

  ```js JavaScript theme={null}
  const crypto = require('crypto');
  const signature = crypto
    .createHmac('sha256', signingKey)
    .update(payloadJsonString)
    .digest('hex');
  ```

  ```python Python theme={null}
  import hmac
  import hashlib
  signature = hmac.new(
      signingKey.encode(),
      payloadJsonString.encode(),
      hashlib.sha256
  ).hexdigest()
  ```

  ```csharp C# theme={null}
  using System.Security.Cryptography;
  using System.Text;
  var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(signingKey));
  var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(payloadJsonString));
  var signature = BitConverter.ToString(hash).Replace("-", "").ToLower();
  ```

  ```java Java theme={null}
  import javax.crypto.Mac;
  import javax.crypto.spec.SecretKeySpec;
  Mac mac = Mac.getInstance("HmacSHA256");
  SecretKeySpec keySpec = new SecretKeySpec(
      signingKey.getBytes("UTF-8"), "HmacSHA256");
  mac.init(keySpec);
  byte[] hash = mac.doFinal(payloadJsonString.getBytes("UTF-8"));
  StringBuilder sb = new StringBuilder();
  for (byte b : hash) sb.append(String.format("%02x", b));
  String signature = sb.toString();
  ```
</CodeGroup>

Generate the same value in your endpoint and compare it with the `Signature` header value.