Using Webhooks with the Manufacturing Data Model API

A webhook is a way for APS to send you a notification when an event that you are interested in occurs. When the event occurs, APS sends a POST request to a URL that you specify. This URL is referred to as a Callback URL and the POST request sent by APS is referred to as the Callback. The Manufacturing Data Model API provides the createWebhook mutation to let you subscribe to events you want to monitor. When you subscribe to the event, you get to specify the Callback URL.

The Manufacturing Data Model API lets you set up a webhook to kick off a downstream process whenever a milestone is created on a specified component. You specify the component and the event when you subscribe. You can also specify a filter so that only milestones with specific names will generate a notification. For more information on filtering, see the webhooks documentation on Callback Filtering.

At the time you subscribe, you can specify how long the webhook must remain active. When the subscription expires, the webhook is deleted automatically. If you do not specify expiration details, the lifespan of the webhook defaults to one year.

Besides createWebhook the API provides the following to let you manage webhooks:

See the code sample Know when a new milestone is available for a demonstration of how to use the Manufacturing Data Model API to subscribe to a webhook event.

When a subscribed event occurs, the Data Eventing service sends a POST request to the Callback URL you specified. The following code snippet is an example of the Callback payload. The highlighted lines contain the information about the webhook event you subscribed to. The remainder contains metadata added by the Data Eventing service.

{
  "id":"7be945d4-88cb-4b19-8dc9-f1dace8ff0c8",
  "source":"urn:com.autodesk.forge:clientid:5zw90va0UuwMKTnPS5sLsdgZjDkVYXN7",
  "specversion":"1.0",
  "type":"autodesk.data.pim:events.milestone.created-1.0.0",
  "subject":"urn:autodesk.data.pim:component:Y29tcH5jby5Kd254Q0p3YVNQeWcwbGRGdUZpNkxRfkJOeUsydk1Ua20ySFdPWEE1M1oyMWNfYWdhfnFyTWxHTjFubzFzeWJVOWNXaU43WjI",
  "time":"2020-03-11T17:54:07.074+00:00",
  "dataschema":" http://forge.autodesk.com/schemas/pim-event-schema-v1.0.0.json",
  "data":{
    "eventtype":"MILESTONE_CREATED",
    "componentid":"Y29tcH5jby5Kd254Q0p3YVNQeWcwbGRGdUZpNkxRfkJOeUsydk1Ua20ySFdPWEE1M1oyMWNfYWdhfnFyTWxHTjFubzFzeWJVOWNXaU43WjI",
    "milestonename":"new milestone v1"
  }
}

When you subscribe to a webhook event, you get the option of specifying a secret token for that subscription. When the secret token is set, the Data Eventing service uses it to create a hash signature for each Callback. This hash signature is sent as a header (x-adsk-signature ) with the Callback. To validate that the notification came from Autodesk, compute your own hash using the secret token. If the hash you compute matches the hash sent as the x-adsk-signature header, you are assured that the notification is not spoofed.

The Data Eventing service uses an HMAC hexdigest to compute the hash.