# Webhook request body and validating hash

**URL:** <https://community.hubspot.com/t/webhook-request-body-and-validating-hash/15637>\
**Category:** APIs & Integrations\
**Tags:** workflows, webhooks\
**Created:** [August 7, 2019, 8:38am UTC](https://community.hubspot.com/t/webhook-request-body-and-validating-hash/15637 "2019-08-07T08:38:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![alvinlzg](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/alvinlzg/32/2679_2.png) [@alvinlzg](https://community.hubspot.com/u/alvinlzg)\
**Post date:** [August 7, 2019, 8:38am UTC](https://community.hubspot.com/t/webhook-request-body-and-validating-hash/15637/1 "2019-08-07T08:38:34Z")

</div>

Hi all,

I’m currently using workflow webhook. I understand that the JSON body will consist of the whole Contact object and that cannot be changed. My question is, how can I then get the request body and validate the hash?

Is it my client has to use the entire request body passed from HS and generate the hash like below and finally compare it?

```auto
client_secret = 'yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy'
http_method = 'POST'
http_uri = 'https://www.example.com/webhook_uri'
source_string = client_secret + http_method + http_uri + request_body
hashlib.sha256(source_string).hexdigest()

```

Is there any way I can monitor this from the App (with the client secret)?

Thanks.

---

<div class="post-metadata">

**Author:** ![Derek\_Gervais](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/derek_gervais/32/17429_2.png) [@Derek\_Gervais](https://community.hubspot.com/u/Derek_Gervais)\
**Post date:** [August 7, 2019, 8:10pm UTC](https://community.hubspot.com/t/webhook-request-body-and-validating-hash/15637/2 "2019-08-07T20:10:22Z")

</div>

Hey @alvinlzg,

You’re exactly correct; to validate the signature, you’ll need to concatenate your secret, method, URI, and request body & hash them. There isn’t any way to monitor this validation in the HubSpot App Monitoring, since the actual comparison is happening in your code.

Also, just to clarify, the ‘request body’ in this case is everything in the body that you recieve from HubSpot. So the full contact record is what’s included in the concatenated string & hashed.

---

<div class="post-metadata">

**Author:** ![alvinlzg](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/alvinlzg/32/2679_2.png) [@alvinlzg](https://community.hubspot.com/u/alvinlzg)\
**Post date:** [August 8, 2019, 9:53am UTC](https://community.hubspot.com/t/webhook-request-body-and-validating-hash/15637/3 "2019-08-08T09:53:09Z")

</div>

Thanks! It’s that simple.

I’ll have to figure out the longer term solution so that I only pass selected properties through.

Thanks again

---

<div class="post-metadata">

**Author:** ![Derek\_Gervais](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/derek_gervais/32/17429_2.png) [@Derek\_Gervais](https://community.hubspot.com/u/Derek_Gervais)\
**Post date:** [August 8, 2019, 3:21pm UTC](https://community.hubspot.com/t/webhook-request-body-and-validating-hash/15637/4 "2019-08-08T15:21:49Z")

</div>

Hey @alvinlzg ,

Glad I could help! As far as only passing certain properties is concerned; you might want to investigate [Workflow extensions](https://developers.hubspot.com/docs/methods/workflow-extensions/workflow-extensions-overview) and/or the [Webhooks API](https://developers.hubspot.com/docs/methods/webhooks/webhooks-overview). Configuring and using them is more involved than the workflow webhook action, but they’re far more flexible and extensible, and allow you to configure specific property change subscriptions, among other things.

---

<div class="post-metadata">

**Author:** ![alvinlzg](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/alvinlzg/32/2679_2.png) [@alvinlzg](https://community.hubspot.com/u/alvinlzg)\
**Post date:** [August 9, 2019, 3:48am UTC](https://community.hubspot.com/t/webhook-request-body-and-validating-hash/15637/5 "2019-08-09T03:48:47Z")

</div>

Thanks for the tips!