Webhook registration endpoint in Rest API - Step-by-Step Execution

Concept Flow - Webhook registration endpoint

Client sends POST request with webhook URL

↓

Server receives request and parses data

↓

Validate webhook URL format

↓

Store webhook URL

↓

Return success response

↓

END

The server receives a webhook URL from the client, validates it, stores it if valid, and returns success or error.

Execution Sample

Rest API

POST /register-webhook
Body: {"url": "https://example.com/hook"}

if valid_url:
  save_url()
  return 200 OK
else:
  return 400 Bad Request

This code receives a webhook URL, checks if it's valid, saves it, and responds accordingly.

Execution Table

Step	Action	Input Data	Validation Result	Storage Action	Response
1	Receive POST request	{"url": "https://example.com/hook"}	Pending	No	No
2	Parse JSON body	{"url": "https://example.com/hook"}	Pending	No	No
3	Validate URL format	https://example.com/hook	Valid	No	No
4	Store webhook URL	https://example.com/hook	Valid	Stored	No
5	Send response	N/A	Valid	Stored	200 OK
6	End	N/A	N/A	Stored	Request complete

💡 Webhook URL is valid and stored, server returns 200 OK and ends processing.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
request_body	None	{"url": "https://example.com/hook"}	{"url": "https://example.com/hook"}	{"url": "https://example.com/hook"}	{"url": "https://example.com/hook"}	{"url": "https://example.com/hook"}
webhook_url	None	None	https://example.com/hook	https://example.com/hook	https://example.com/hook	https://example.com/hook
validation_result	None	None	None	Valid	Valid	Valid
storage_status	None	None	None	None	Stored	Stored
response_status	None	None	None	None	None	200 OK

Key Moments - 2 Insights

Why do we validate the webhook URL before storing it?

Validation ensures the URL is correctly formatted and reachable, preventing errors later. See execution_table step 3 where validation decides if we store or reject.

What happens if the URL is invalid?

The server returns an error response and does not store the URL. This is shown in the concept_flow where the 'No' branch leads to an error response.

Visual Quiz - 3 Questions

Look at the execution_table, what is the validation result at step 3?

A Pending

B Invalid

C Valid

D Stored

💡 Hint

Check the 'Validation Result' column at step 3 in execution_table.

At which step is the webhook URL stored?

A Step 3

B Step 4

C Step 2

D Step 5

💡 Hint

Look at the 'Storage Action' column in execution_table to find when 'Stored' appears.

If the webhook URL was invalid, what would change in the execution_table?

A Validation Result would be 'Invalid' and Storage Action would be 'No'

B Response would be '200 OK'

C Storage Action would be 'Stored' anyway

D Request Body would be empty

💡 Hint

Refer to concept_flow where invalid URL leads to error response and no storage.

Concept Snapshot

Webhook registration endpoint:
- Receives POST with JSON body containing 'url'
- Validates URL format
- Stores URL if valid
- Returns 200 OK on success
- Returns error if invalid
- Ensures only valid webhooks are registered

Full Transcript

This visual execution shows how a webhook registration endpoint works step-by-step. The client sends a POST request with a webhook URL. The server receives and parses the request body. It then validates the URL format. If valid, the server stores the URL and returns a 200 OK response. If invalid, it returns an error without storing. Variables like request_body, webhook_url, validation_result, storage_status, and response_status change as the steps progress. Key moments include why validation is important and what happens on invalid input. The quiz tests understanding of validation results, storage timing, and error handling.

Practice

1.

What is the main purpose of a webhook registration endpoint in a REST API?

easy

A. To update the API documentation automatically

B. To send event data directly to all users

C. To store user login credentials securely

D. To let apps register their callback URL to receive event updates

Solution

1. Step 1: Understand webhook registration

   A webhook registration endpoint allows external apps to tell your system where to send event notifications.

2. Step 2: Identify the main function

   The main function is to register a callback URL and event type so your system knows where to send updates.

3. Final Answer:

   To let apps register their callback URL to receive event updates -> Option D

4. Quick Check:

   Webhook registration = register callback URL [OK]

Hint: Webhook registration means saving callback URLs for events [OK]

Common Mistakes:

• Confusing webhook registration with sending events
• Thinking it stores user credentials
• Assuming it updates documentation

2.

Which HTTP method is typically used to register a webhook endpoint?

easy

A. POST

B. GET

C. DELETE

D. PUT

Solution

1. Step 1: Recall HTTP methods for creating resources

   POST is used to send data to the server to create a new resource, like registering a webhook.

2. Step 2: Eliminate other methods

   GET retrieves data, DELETE removes data, PUT updates existing data. Registration is creation, so POST fits best.

3. Final Answer:

   POST -> Option A

4. Quick Check:

   Register webhook = POST request [OK]

Hint: Use POST to send data and create webhook registrations [OK]

Common Mistakes:

• Using GET instead of POST for registration
• Confusing PUT with POST
• Using DELETE by mistake

3.

Given this JSON payload sent to a webhook registration endpoint:
{"callback_url": "https://example.com/hook", "event": "order_created"}
What should the server respond if the registration is successful?

medium

A. {"status": "success", "message": "Webhook registered"}

B. {"error": "Invalid URL"}

C. {"status": "failed", "message": "Missing event type"}

D. {"status": "success", "message": "Webhook deleted"}

Solution

1. Step 1: Analyze the input payload

   The payload contains a valid callback URL and an event type, so it should be accepted.

2. Step 2: Determine expected success response

   On success, the server confirms registration with a success status and message.

3. Final Answer:

   {"status": "success", "message": "Webhook registered"} -> Option A

4. Quick Check:

   Valid input = success confirmation [OK]

Hint: Success means status success and confirmation message [OK]

Common Mistakes:

• Confusing error messages as success
• Ignoring missing fields
• Mixing registration and deletion messages

4.

Consider this snippet of a webhook registration handler in Python Flask:

from flask import Flask, request, jsonify
app = Flask(__name__)

@app.route('/register', methods=['POST'])
def register_webhook():
    data = request.json
    if 'callback_url' not in data or 'event' not in data:
        return jsonify({'error': 'Missing fields'}), 400
    # Assume registration logic here
    return jsonify({'status': 'success', 'message': 'Webhook registered'})

What error will occur if the client sends an empty POST body?

medium

A. No error, returns success

B. TypeError because request.json is a string

C. TypeError because data is None and keys are accessed

D. 404 Not Found error

Solution

1. Step 1: Understand request.json behavior on empty body

   If the POST body is empty, request.json returns None, not a dictionary.

2. Step 2: Analyze the if condition

   The code tries to check keys in data, but data is None, so 'in' operation causes a TypeError.

3. Final Answer:

   TypeError because data is None and keys are accessed -> Option C

4. Quick Check:

   Empty body means request.json is None causing key access error [OK]

Hint: Empty JSON body makes request.json None, causing TypeError [OK]

Common Mistakes:

• Assuming empty body returns empty dict
• Expecting success without data
• Confusing error types

5.

You want to build a webhook registration endpoint that only accepts URLs starting with https:// and event types from a fixed list: ["order_created", "order_shipped"]. Consider this Python validation function:

def validate_webhook(data):
    callback = data.get('callback_url')
    event = data.get('event')
    if not callback.startswith('https://'):
        return False
    if event not in ['order_created', 'order_shipped']:
        return False
    return True

Which statement best describes its behavior?

hard

A. Correctly validates both URL scheme and event type

B. Fails if callback_url is missing, causing AttributeError

C. Allows any URL scheme, no validation done

D. Only checks event type, ignores URL

Solution

1. Step 1: Check callback_url usage

   The code calls startswith on callback without checking if callback is None, so if missing, it raises AttributeError.

2. Step 2: Verify event type check

   The event type check is correct, but the missing callback check causes failure before this.

3. Final Answer:

   Fails if callback_url is missing, causing AttributeError -> Option B

4. Quick Check:

   Missing callback_url causes error on startswith call [OK]

Hint: Check for None before calling string methods to avoid errors [OK]

Common Mistakes:

• Not checking if callback_url exists before startswith
• Assuming event type validation covers all errors
• Ignoring input validation order