Webhooks

Instead of polling GET /api/v1/FlightBooking/{attemptId}, subscribe to webhooks to be notified the moment a booking attempt reaches a terminal state.

Registering a webhook

POST /api/v1/FlightBooking/Webhooks:

{
  "url": "https://your-server.example.com/webhooks/ondgo",
  "events": ["flight_booking.completed", "flight_booking.failed"]
}

• url must be HTTPS, and must resolve to a public address — it cannot point at localhost or a private/internal IP address.
• events defaults to both event types if omitted.
• The response includes a signing secret, returned once, at creation. Store it securely — it isn't shown again.

Event types

Event	Fired when
flight_booking.completed	A booking attempt reaches Completed.
flight_booking.failed	A booking attempt reaches Failed.

Verifying a delivery

Every delivery includes three headers:

X-Ondgo-Event-Id: <unique id for this delivery>
X-Ondgo-Timestamp: <unix timestamp, seconds>
X-Ondgo-Signature: sha256=<hex-encoded HMAC-SHA256>

The signature is computed over {timestamp}.{eventId}.{payload} (the raw request body, dot-joined with the two header values above), using your webhook's own signing secret:

import hashlib
import hmac

def verify(secret: str, timestamp: str, event_id: str, payload: str, signature_header: str) -> bool:
    expected = hmac.new(
        secret.encode(),
        f"{timestamp}.{event_id}.{payload}".encode(),
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(f"sha256={expected}", signature_header)

Reject any delivery whose signature doesn't match — this confirms the payload actually came from OnDgo and wasn't tampered with in transit.

Delivery retries

A delivery that fails (your endpoint returns a non-2xx status, or the request times out) is retried automatically. Make your webhook handler idempotent by X-Ondgo-Event-Id — you may receive the same event more than once.

Managing webhooks

• GET /api/v1/FlightBooking/Webhooks — list your registered webhooks.
• GET /api/v1/FlightBooking/Webhooks/{id} — get one.
• PUT /api/v1/FlightBooking/Webhooks/{id} — update the URL, events, or secret.
• DELETE /api/v1/FlightBooking/Webhooks/{id} — remove one.

Full request/response shapes are in the API Reference.