Census Webhooks Skill

Census is now Fivetran Activations (getcensus.com redirects to fivetran.com). Its sync lifecycle webhooks tell your systems when a reverse ETL sync is queued, running, finished, failed, or alerting. This is separate from the fivetran-webhooks skill, which covers Fivetran's REST API webhooks (X-Fivetran-Signature-256, hex).

When to Use This Skill

• How do I receive Census (Fivetran Activations) webhooks?
• How do I verify the X-Signature header on a Census webhook?
• How do I handle sync.completed, sync.success, sync.failed, or sync.alert.raised events?
• Why is my Census webhook signature verification failing?
• How do I trigger downstream jobs or alerts when a Census sync finishes or fails?

Verification (core)

Census signs the raw request body with HMAC-SHA256, keyed with the one-time secret shown when you create the webhook (used as raw bytes, no whsec_ handling), and sends the digest as standard base64 (not hex) in X-Signature. There is no timestamp and no prefix.

Node:

const crypto = require('crypto');

function verify(rawBody, signatureHeader, secret) {
  if (!signatureHeader || !secret) return false;
  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('base64');
  try {
    return crypto.timingSafeEqual(Buffer.from(signatureHeader.trim()), Buffer.from(expected));
  } catch {
    return false; // different lengths
  }
}

Python:

import base64, hmac, hashlib

def verify(raw_body: bytes, signature_header: str | None, secret: str) -> bool:
    if not signature_header or not secret:
        return False
    expected = base64.b64encode(
        hmac.new(secret.encode(), raw_body, hashlib.sha256).digest()
    ).decode()
    return hmac.compare_digest(signature_header.strip(), expected)

In Express, read the body with express.raw({ type: '*/*' }) so the bytes are intact whatever Content-Type is sent.

For complete handlers with route wiring, event dispatch, and tests, see:

• examples/express/
• examples/nextjs/
• examples/fastapi/

Common Event Types

The event name is in the JSON body (event); there is no event-type header. Every payload has workspace_id, sync_id, sync_run_id, and event.

For the full reference, see Sync lifecycle webhooks.

Important Details

Environment Variables

CENSUS_WEBHOOK_SECRET=your_webhook_secret   # One-time secret shown when the webhook is created

Local Development

# Start tunnel (no account needed)
npx hookdeck-cli listen 3000 census --path /webhooks/census

Reference Materials

• references/overview.md - Census webhook concepts and payloads
• references/setup.md - Creating a webhook and getting the secret
• references/verification.md - Signature verification details