# Survicate Webhooks

Receive Survicate question answers and completed surveys.

## When to Use This Skill

* Configure a receiver for Survicate webhook deliveries.
* Diagnose `hmac` verification failures.
* Handle `questionAnswered`, `surveyCompleted`.

## Setup

Copy the workspace Signing Secret from Survicate Webhooks Settings. In the survey's Connect tab, configure the webhook URL and choose questionAnswered or surveyCompleted. Use Send sample request to test. The separate Verification Token is sent in plaintext and is not used by this HMAC verifier.

Set `SURVICATE_WEBHOOK_SECRET` in the server environment. Read [setup](https://github.com/hookdeck/webhook-skills/blob/main/skills/survicate-webhooks/references/setup.md) before enabling delivery.

## Verification (core)

`hmac` contains a bare hex digest over the raw body. Use HMAC-SHA256 with the secret's UTF-8 bytes. Verify the original bytes before parsing JSON. Validate the digest format, then compare equal-length buffers in constant time.

After extracting the documented digest and constructing `message` as described in [verification](https://github.com/hookdeck/webhook-skills/blob/main/skills/survicate-webhooks/references/verification.md), the comparison is:

```javascript
const expected = crypto.createHmac('sha256', secret).update(message).digest();
if (digest.length !== 64 || !/^[0-9a-fA-F]{64}$/.test(digest)) return false;
const received = Buffer.from(digest, 'hex');
return received.length === expected.length && crypto.timingSafeEqual(received, expected);

```

No timestamp is included in the signed message. These examples do not invent an age check from unsigned fields.

Complete handlers and tests: [Express](https://github.com/hookdeck/webhook-skills/tree/main/skills/survicate-webhooks/examples/express/), [Next.js](https://github.com/hookdeck/webhook-skills/tree/main/skills/survicate-webhooks/examples/nextjs/), [FastAPI](https://github.com/hookdeck/webhook-skills/tree/main/skills/survicate-webhooks/examples/fastapi/).

## Event Handling

The envelope is {messageId, deliveryTries, event: {questionAnswered: {...}}} or the corresponding surveyCompleted key. Dispatch on keys inside event, not on event as a string. The receiver guards each nested value before use.

Use messageId when deduplicating deliveries. Acknowledge accepted events and avoid logging survey answers or personal data.

## Local Development

```bash
npx hookdeck-cli listen 3000 survicate --path /webhooks/survicate

```

Use port 8000 for FastAPI. The CLI provides a local tunnel and inspection UI; no account is required to start.

## Resources

* [Overview and event routing](https://github.com/hookdeck/webhook-skills/blob/main/skills/survicate-webhooks/references/overview.md)
* [Endpoint and secret setup](https://github.com/hookdeck/webhook-skills/blob/main/skills/survicate-webhooks/references/setup.md)
* [Verification and troubleshooting](https://github.com/hookdeck/webhook-skills/blob/main/skills/survicate-webhooks/references/verification.md)