Question

A developer has built an integration that receives Webex messaging webhooks at a public HTTPS endpoint. Security review flags that anyone who discovers the URL could POST fake events to the endpoint. The developer wants to guarantee that incoming webhook payloads genuinely originate from Webex before processing them. Which approach correctly satisfies this requirement?

Accepted Answer

Set a 'secret' when creating the webhook, then validate the X-Spark-Signature HMAC-SHA1 header against the raw payload on each received request

Answer

Require an OAuth bearer access token to be included in the Authorization header of every webhook Webex sends to the endpoint

Answer

Configure the webhook with a 'filter' parameter so that only messages from trusted rooms trigger delivery to the endpoint

Answer

Restrict the firewall to allow inbound connections only from a single static Webex source IP address documented in Control Hub