Reference

DROP sends notifications to data brokers based on system activity. By default, the notifications below are sent via email to primary and secondary email addresses on your DROP account. Optionally, you may enable webhooks for these notifications.

Events

Webhook configuration

To enable webhook notifications:

1. Go to Notification settings in the Data Broker Portal.
2. Toggle Webhook to Active.
3. Enter your HTTPS endpoint URL.
4. Save changes.

Signing secret:

When you enable webhooks, a signing secret is generated and shown in the portal. Store this secret securely in your webhook receiver configuration. It is used to verify that incoming webhook requests are sent by DROP. Rotate the secret as needed for security.

Supported webhook messages

HTTP headers

Each webhook request includes:

Webhook body

Each webhook request includes a JSON body.

{ 
 "message": message text, 
} 

Example

POST https://example.com/drop/webhook 
Content-Type: application/json 
X-Webhook-Event-Id: 00000000-0000-0000-0000-000000000000 
X-Webhook-Event-Type: download.ready 
X-Webhook-Delivery-Id: 11111111-1111-1111-1111-111111111111 
X-Webhook-Timestamp: 2026-07-02T18:30:00.0000000Z 
X-Webhook-Version: 1.0 
X-Webhook-Signature: sha256=abc123... 
 
{ 
 "message": "download ready" 
} 

Secret verification

DROP signs each webhook using the data broker’s webhook signing secret.

To verify:

1. Read the raw request body exactly as received.
2. Read X-Webhook-Timestamp.
3. Build the signing string: <timestamp>.<raw request body>
4. Compute HMAC-SHA256 using the webhook signing secret.
5. Compare the hex digest to X-Webhook-Signature after removing the sha256= prefix.
6. Reject the request if the signature is invalid.

Example logic:

const expected = hmacSha256Hex(secret, `${timestamp}.${rawBody}`); 

const received = signatureHeader.replace("sha256=", ""); 

 

if (constantTimeEqual(expected, received)) { 

  // valid DROP webhook 

} else { 

  // reject 

} 

Recommended: reject webhook requests with timestamps older than five minutes to prevent out of date webhook requests.

Expected response

Return any 2xx status when the webhook is received successfully.
Preferred response: HTTP/1.1 204 No Content
DROP treats non-2xx responses as failed delivery and may retry.

Use the Data Broker Portal for account setup, credentials, and to contact us.

When reporting an issue, include:

• Timestamp (Pacific Time)
• Endpoint and HTTP status code
• File name involved
• Upload response payload or error message