Cyberimpact Webhooks Skill

Cyberimpact is an email marketing platform. Its marketing automation scenarios have a Send a webhook action that POSTs a JSON body to a URL you choose when a contact reaches that step. Webhooks are not signed. You authenticate them with a secret header: you add a key-value pair to the action's webhook headers, and your endpoint checks that header on every request.

When to Use This Skill

• How do I receive Cyberimpact webhooks?
• How do I authenticate a Cyberimpact "Send a webhook" action?
• Does Cyberimpact sign webhook payloads? (No: use a secret header you define)
• How do I handle the automation.webhook.send event and its contact data?
• Why does my Cyberimpact webhook endpoint return 401?

Verification (core)

const crypto = require('crypto');

// Hash both sides: equal-length buffers, so timingSafeEqual never throws.
function safeEqual(a, b) {
  const ha = crypto.createHash('sha256').update(String(a)).digest();
  const hb = crypto.createHash('sha256').update(String(b)).digest();
  return crypto.timingSafeEqual(ha, hb);
}

function verifyCyberimpactRequest(headers, {
  name = process.env.CYBERIMPACT_WEBHOOK_HEADER || 'Authorization',
  secret = process.env.CYBERIMPACT_WEBHOOK_SECRET,
} = {}) {
  if (!secret) return false;                   // never accept when unconfigured
  const received = headers[name.toLowerCase()]; // Node lowercases header names
  return Boolean(received) && safeEqual(received, secret); // WHOLE value, exact match
}

• You choose the header. In the action's Headers section add a key-value pair. Use a simple header name without spaces or special characters, such as Authorization. Cyberimpact does not allow spaces or special characters in header keys.
• The expected value is the exact, whole header value, including any Bearer prefix you typed. Compare the whole value; do not strip or parse a prefix.
• The header name is read from CYBERIMPACT_WEBHOOK_HEADER (default Authorization) and matched case-insensitively. The value comes from CYBERIMPACT_WEBHOOK_SECRET.
• Return 401 for a missing header or a mismatch, 400 for a body that isn't a JSON object, 200 once handled. The Test button expects 200.
• Read the body raw (express.raw({ type: '*/*' })) and authenticate before parsing it.

Security note: a static shared credential authenticates the sender, not the body, and gives no replay protection (there is no signature and no timestamp). Use HTTPS only, and rotate the credential in both the scenario and your endpoint if it leaks.

For complete handlers with tests, see examples/express/, examples/nextjs/, examples/fastapi/.

Event Types

Every request has event set to automation.webhook.send. What differs is the data the scenario author selected.

Body shape (the Test button sends this):

{
  "id": "test_evt_GppedVq2CWTWxUUxrm26bic0C",
  "event": "automation.webhook.send",
  "timestamp": "2024-05-28T12:56:40Z",
  "idClient": 3,
  "data": { "type": "member", "id": 54321, "email": "john.doe@example.org", "firstname": "John", "lastname": "Doe" }
}

Real deliveries add the contact fields and the key-value pairs chosen in Data to be transmitted and Additional information. Trigger a test delivery to see the exact shape.

Environment Variables

CYBERIMPACT_WEBHOOK_HEADER=Authorization        # header key you added in the webhook headers
CYBERIMPACT_WEBHOOK_SECRET=your-secret-value    # exact, whole header value (include "Bearer " if you typed it)

Local Development

Cyberimpact can't reach localhost. Tunnel with the Hookdeck CLI (no account required):

npx hookdeck-cli listen 3000 cyberimpact --path /webhooks/cyberimpact

Use the printed URL as the webhook URL in the scenario action.

Resources

• references/overview.md - What Cyberimpact webhooks are, event and payload shape
• references/setup.md - Add the Send a webhook action and the secret header
• references/verification.md - Header check details, gotchas, debugging 401s
• examples/ - Runnable Express, Next.js and FastAPI handlers with tests