Build a receiver: the recommended pattern

Technical details of a receiver that's secure, idempotent and fast.

Steps

Accept the POST and keep the raw body.
Verify the signature. See “Verify the signature”.
Optionally reject timestamps more than 5 minutes old.
If you've already processed this id, return 200 and stop.
Switch on type.
Identify the person, by data.user.email or your ID mapping. See “Identify people: user IDs or personal data”.
Queue the ticket or HR work, record the id, and return 2xx.

course.assigned: open Complete: {title} for the person (or their manager). Store the Empath user ID and course ID on the ticket so the completion can find it.
course.completed: find that ticket and close it. If there isn't one, because events arrived out of order or the assignment was made before your integration, log the completion anyway.
knowledge_check.failed: open or update a coaching ticket. Don't assume you have a course name.
content.published: notify your content or ops team. Don't open tickets per person.

Automation platforms such as Rewst can be the receiver: point the webhook at the platform's inbound webhook trigger URL and do the signature check and mapping in the workflow.

Reach out to your Partner Success Manager, or email us at support@empathmsp.com. We’re happy to help!