Webhook

In Riversoft® STCP DirectLink, Webhook is document exchange with partners over HTTP/HTTPS. Each side of the exchange has a role:

Component	Who starts the connection	Function
Webhook connector	Riversoft STCP DirectLink (outbound connection)	Sends the user’s documents to the partner’s HTTP/HTTPS endpoint.
Webhook DirectLink service	The partner (inbound connection)	Receives the documents the partner sends to Riversoft STCP DirectLink.

In Webhook, each connection carries documents in a single direction. For the partner to send documents too, they connect to the Webhook DirectLink service.

Outbound connections (Webhook connector)

    flowchart LR
    subgraph DL[Riversoft STCP DirectLink]
      SA["saida directory"]
      C[Webhook connector]
    end
    SA --> C
    C -->|document and headers| P[Partner endpoint]

Riversoft STCP DirectLink delivers to the partner’s endpoint, in an HTTP/HTTPS request, each document available in the user’s mailbox (saida directory), by schedule or when the operator starts the connection in the Riversoft Console Portal. The partner’s response is recorded in the transfer log.

Feature	Description
Endpoint	URL of the partner that receives the documents.
Identification	Sender and recipient identifiers of the exchange, set in the user registration.
Authentication	None, Basic or Bearer, as required by the partner, with the credentials protected in the registration.
Signature and encryption	Signature with the Riversoft STCP DirectLink certificate and key and encryption with the partner’s certificate, with the agreed algorithm.
Custom headers	Fixed headers set in the user registration and per-file headers, sent in the file metadata.
TLS	Partner certificate validation, custom CA and client certificate (mTLS).
Network	The connection can go through a proxy and through a specific local address.
Timeout	Maximum time of each send.

The Webhook connector only sends documents: it does not list, download or remove files at the partner.

Inbound connections (Webhook DirectLink service)

    flowchart LR
    subgraph DL[Riversoft STCP DirectLink]
      S[Webhook DirectLink service]
      EN["entrada directory"]
    end
    Q[Partner system] -->|document and authentication| S
    S --> EN

The partner sends documents to the Webhook DirectLink service endpoint. Each request is authenticated, associated with a user and written to the entrada directory of their mailbox.

Authentication	Validation
None	Only for controlled environments.
Basic	Riversoft STCP DirectLink user and password.
Bearer	Only an impersonation token registered for the user; the token `sub` must match the partner identification.

Besides the credential, the recipient given in the request (X-To header) must match the identification registered for the partner. The service accepts TLS with configurable minimum and maximum versions and client certificate authentication (mTLS).

The Webhook DirectLink service is registered in the instance network services, in the Riversoft Console Portal: address, port, TLS and the public service address.

What to agree with the partner

Item	Description
Addresses	Partner endpoint URL and public Webhook DirectLink service URL.
Identifications	Sender and recipient identifiers in both directions.
Authentication	Basic or Bearer, in both directions.
Certificates	Signing and encryption certificates, when used, and the algorithms.
Headers	Headers the partner expects to receive.

Security

Publish the Webhook DirectLink service over HTTPS only and, whenever possible, require mTLS from the partner.
Prefer Bearer with an impersonation token or Basic to no authentication; keep the credentials in a secrets vault.
Use signature and encryption when the partner supports them.
Keep partner certificate validation enabled in the connector.

SFTP WhatsApp