Imported Numbers and Hosting Orders Callbacks

You can set up callback URLs to receive event notifications when your numbers are updated.

When delivering events the order is not guaranteed (for example, a failed event scheduled for retry will not block other events that were queued).

The client's callback handler must implement the state machine that can decide what to do with unexpected events, for example, "old" events or invalid state transitions. In these cases the handler could use the API to GET the latest state for the resource.

The callback handler is expected to "ingest" the event and respond with 200 OK. The domain-specific business logic and processes should be executed outside of the callback request, as internal asynchronous jobs.

To use callbacks, add the following IP addresses to your allowlist:

• 54.76.19.159
• 54.78.194.39
• 54.155.83.128

Secure Webhook Endpoints with HMAC

Implementing HMAC (Hash-based Message Authentication Code) on your webhook endpoints will ensure the integrity of data, preventing tampering during transmission. An HMAC used in webhooks is a common approach in the industry and essentially it is just special code that can be used to check if a message hasn't been tampered with during the transmission.

We recommend to configure an HMAC secret for your project using the callback configuration. Then, when sending the number events, the HTTP POST requests will include the header X-Sinch-Signature with the computed HMAC.

NOTE: The HMAC secret is configured per project; if you are using the Numbers API with multiple projects, make sure you configure the HMAC secret in each project, and fetch it for either imported or purchased numbers from the dedicated endpoints.

HMAC verification

We recommend to verify the HMAC code received with every event in your event handler. When receiving a new event on your endpoint URL, compute the HMAC of the payload using the secret (configured here) and compare it with one received in the X-Sinch-Signature header.

NOTE: Compute the HMAC on the plain text value before parsing the JSON payload.