# Nexthink Webhooks

Nexthink (digital employee experience) can push an HTTP request to your server when an alert
or event matches a webhook's NQL condition. Webhooks are **not signed**. The only
authentication is the `Authorization` header built from the connector credential you attach
to the webhook. The method (POST, PUT or PATCH) and the JSON body are whatever you configure.

## When to Use This Skill

* How do I receive Nexthink webhooks?
* How do I verify the `Authorization: Bearer <token>` header from a Nexthink webhook?
* Does Nexthink sign webhook payloads? (No: shared credential header only)
* Why does my Nexthink webhook endpoint return 401?
* How do I handle the `{{alert.monitor.name}}` template payload Nexthink sends?

## Verification (core)

Create a **Bearer token** connector credential and attach it to the webhook. Nexthink sends
`Authorization: <Header prefix> <Token>`, usually `Authorization: Bearer <token>`. Set
`NEXTHINK_AUTHORIZATION` to the **whole header value, scheme prefix included**, and compare the
whole `Authorization` header to it. Don't strip, parse or base64-decode the prefix:

```javascript
const crypto = require('crypto');

// Hash both sides: equal-length buffers, so timingSafeEqual never throws.
function safeEqual(a, b) {
  const ha = crypto.createHash('sha256').update(String(a)).digest();
  const hb = crypto.createHash('sha256').update(String(b)).digest();
  return crypto.timingSafeEqual(ha, hb);
}

function verifyNexthinkRequest(headers, expected = process.env.NEXTHINK_AUTHORIZATION) {
  if (!expected) return false;                // never accept when unconfigured
  const received = headers['authorization'];  // full value, e.g. "Bearer abc123"
  return Boolean(received) && safeEqual(received, expected);
}

```

Return `401` when this fails, `400` for a non-empty body that isn't valid JSON, and `200`
once handled. Read the body raw (`express.raw({ type: '*/*' })`) and parse it only after the
check. Accept **POST, PUT and PATCH** (the webhook Method dropdown) and handle an empty body.
Python and Next.js equivalents are in [references/verification.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/nexthink-webhooks/references/verification.md).

> **A static shared credential authenticates the sender, not the body, and gives no replay
> protection** (no signature, no timestamp). Use HTTPS and rotate the credential if it leaks.

> **For complete handlers with tests**, see [examples/express/](https://github.com/hookdeck/webhook-skills/tree/main/skills/nexthink-webhooks/examples/express/),
> [examples/nextjs/](https://github.com/hookdeck/webhook-skills/tree/main/skills/nexthink-webhooks/examples/nextjs/), [examples/fastapi/](https://github.com/hookdeck/webhook-skills/tree/main/skills/nexthink-webhooks/examples/fastapi/).

## Payload and Events

Nexthink adds no event field. The body is the JSON **Payload template** you write on the
webhook, with `{{variable}}` placeholders from the NQL data model (for example
`{{alert.monitor.name}}`), so you decide the shape. The examples use this clearly
**illustrative** template, with `event` a field you chose and not something Nexthink sends:

```json
{ "event": "alert triggered", "monitor": "{{alert.monitor.name}}" }

```

The examples dispatch on `event` values `alert triggered` and `alert recovered`; see
[references/overview.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/nexthink-webhooks/references/overview.md).

## Setup Note (same as in Hookdeck)

Choose the Bearer token credential type for the webhook and paste the whole Authorization
value here, including "Bearer ". Basic and OAuth credentials are not covered by Hookdeck's
Nexthink source (`NEXTHINK`).

The request method is user-chosen. Hookdeck's Nexthink source pre-selects POST without
managing the method, so if the webhook uses PUT or PATCH, allow that method on the source too.
See [references/setup.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/nexthink-webhooks/references/setup.md).

## Environment Variables

```bash
NEXTHINK_AUTHORIZATION=Bearer your-connector-credential-token   # full header value

```

## Local Development

```bash
npx hookdeck-cli listen 3000 nexthink --path /webhooks/nexthink

```

No account required. Use the printed URL as the credential's URL (and the webhook's Resource
for the path).

## Resources

* [references/overview.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/nexthink-webhooks/references/overview.md) - Webhooks, methods, payload templates, illustrative events
* [references/setup.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/nexthink-webhooks/references/setup.md) - Connector credential and webhook configuration in Nexthink
* [references/verification.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/nexthink-webhooks/references/verification.md) - Header check in Node, Python and Next.js, gotchas
* [examples/](https://github.com/hookdeck/webhook-skills/tree/main/skills/nexthink-webhooks/examples/) - Runnable Express, Next.js and FastAPI handlers with tests