Notification webhooks

OfficeHero has a second, simpler webhook system for sending the apps' notifications to other tools. It is configured in the apps, not with the API.

When to use which

Use integration webhooks (overview) when a system needs OfficeHero’s data changes: they cover 112 event types, are managed with an API key, and are signed with X-OH-Signature.

Use notification webhooks to forward the notifications people see in the apps — for example to a chat channel or an on-call tool.

Setting one up

Admins with the notifications.channels.admin permission add them in the Fleet, HR or Finance app under Settings → Webhooks, choose the notification events, and can send a test event from there.

Verifying them

Each request carries:

Header	Value
`X-Officehero-Signature`	Hex HMAC-SHA256 of `<timestamp>.<raw body>`, keyed with the webhook’s secret
`X-Officehero-Timestamp`	Unix seconds the request was signed at
`X-Officehero-Event`	The notification event type

import hashlib, hmac, time

def verify_notification(secret: str, raw_body: bytes, timestamp: str, signature: str) -> bool:
    if abs(time.time() - int(timestamp)) > 300:
        return False
    expected = hmac.new(secret.encode(), timestamp.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

Note the differences from integration webhooks: the timestamp is a separate header and the signature is bare hex, not t=…,v1=….