Amazon EventBridge

Each outbound message becomes one PutEvents entry on your bus. Rules can route on detail-type, which is the event type by default. Requires the Starter plan or above.

Settings

Field	Required	Notes
`region`	Yes	e.g. `us-east-1`
`eventBusName`	Yes	A bus name or ARN, or `default`
`source`	No	The event's `source`. Defaults to `hookbase`, and can't start with `aws.`.
`detailType`	No	A fixed `detail-type`. Leave it blank to use each event's type.
`accessKeyId` / `secretAccessKey`	Yes	A key with the policy below

The event

EventBridge has no message attributes, so the signature travels in the detail:

{
  "source": "hookbase",
  "detail-type": "order.created",
  "detail": {
    "webhook": {
      "id": "msg_2abc...",
      "timestamp": "1760780400",
      "signature": "v1,K5oZfzN95Z9UVu1EsfQmfVNQhnkZ2pj9o9NDN/H/pI4=",
      "eventType": "order.created",
      "contentType": "application/json"
    },
    "payload": "{\"type\":\"order.created\",\"data\":{...}}",
    "data": { "type": "order.created", "data": { } }
  }
}

detail.payload is the signed string, exactly as signed. detail.data is the same payload parsed (or null if it isn't JSON), so rules and targets can match on its fields. To verify, check detail.payload against webhook.id, webhook.timestamp and webhook.signature:

const { webhook, payload } = event.detail;
wh.verify(payload, {
  'webhook-id': webhook.id,
  'webhook-timestamp': webhook.timestamp,
  'webhook-signature': webhook.signature,
});

An entry, including detail, is limited to 256 KB.

IAM policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "events:PutEvents",
      "Resource": "arn:aws:events:us-east-1:123456789012:event-bus/orders-bus"
    }
  ]
}

PutEvents can return HTTP 200 with a failed entry, for example NotAuthorizedForSourceException. Hookbase treats a failed entry as a failed attempt, classified by its error code.

Field

Required

Notes

region

Yes

e.g. us-east-1

eventBusName

Yes

A bus name or ARN, or default

source

The event's source. Defaults to hookbase, and can't start with aws..

detailType

A fixed detail-type. Leave it blank to use each event's type.

accessKeyId / secretAccessKey

Yes

A key with the policy below

The event

EventBridge has no message attributes, so the signature travels in the detail:

{
  "source": "hookbase",
  "detail-type": "order.created",
  "detail": {
    "webhook": {
      "id": "msg_2abc...",
      "timestamp": "1760780400",
      "signature": "v1,K5oZfzN95Z9UVu1EsfQmfVNQhnkZ2pj9o9NDN/H/pI4=",
      "eventType": "order.created",
      "contentType": "application/json"
    },
    "payload": "{\"type\":\"order.created\",\"data\":{...}}",
    "data": { "type": "order.created", "data": { } }
  }
}

const { webhook, payload } = event.detail;
wh.verify(payload, {
  'webhook-id': webhook.id,
  'webhook-timestamp': webhook.timestamp,
  'webhook-signature': webhook.signature,
});

An entry, including detail, is limited to 256 KB.

IAM policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "events:PutEvents",
      "Resource": "arn:aws:events:us-east-1:123456789012:event-bus/orders-bus"
    }
  ]
}

PutEvents can return HTTP 200 with a failed entry, for example NotAuthorizedForSourceException. Hookbase treats a failed entry as a failed attempt, classified by its error code.