Skip to main content

Webhook Receiver Setup

This section describes how to set up your webhook receiver endpoint to receive onboarding requests from B1Link.

Overview​

Your ERP system must expose a webhook receiver endpoint that can accept HTTP POST requests from B1Link. When a supplier completes onboarding, B1Link will POST supplier information to this endpoint.

Endpoint Requirements​

Your webhook receiver endpoint must:

  • Accept HTTP POST requests
  • Be accessible over HTTPS (required for security)
  • Return appropriate HTTP status codes
  • Handle the webhook payload structure (see Webhook Payload Reference)

Configuration Steps​

  1. Create Your Webhook Endpoint - Implement an HTTP POST endpoint in your ERP system
  2. Ensure HTTPS - Your endpoint must use HTTPS (not HTTP)
  3. Configure in B1Link Portal - Provide your webhook receiver URL to your B1Link administrator
  4. Test the Endpoint - Verify it can receive and process webhook payloads

Endpoint Response​

Your webhook receiver should:

  • Return 200 OK when the webhook is successfully received and processed
  • Return appropriate error status codes (4xx, 5xx) if there are issues
  • Process the payload asynchronously if needed (don't block the response)

Security Considerations​

B1Link does not sign the webhook it sends to your endpoint. There is no HMAC and no signature header on the request, so the request body by itself does not prove that a call came from B1Link. Establish that at the network layer, and validate the payload before you act on it.

  • Accept requests only from B1Link's IP addresses. Configure your gateway or firewall so the endpoint allows traffic from B1Link's platform IP addresses and rejects everything else. Ask your B1Link administrator for the current list of addresses to allow. This is the primary control that a request genuinely came from us.
  • Use HTTPS only. Your endpoint must use HTTPS. It protects the payload in transit, which matters more here because the request is not otherwise authenticated.
  • Validate the payload shape before acting on it. Check that the required fields are present and well-formed rather than assuming a valid structure.
  • Do not log full payload bodies. The payload carries supplier personal information and banking details. Once it reaches your endpoint, your organization is responsible for that data, so log identifiers such as onboardingRequestErpEventId for auditing instead of the full body.

The X-B1LINK-Signature header belongs to the opposite direction. It is what you attach when you call B1Link back with the ERP vendor number, not something B1Link sends you. See Signature Generation for that direction.

Next Steps​