The use of Webhooks in APIs

A large part of our work involves integrating several applications together. The majority of these applications do not have any native integration planned by their authors, but expose what is known as an API (Application Programming Interface) to exchange information.

Let's imagine that we want to synchronise the data in our application with a CRM (contact and customer relationship management application). If this CRM exposes an API, we can regularly make a call to it that basically says "give me all the contacts that have been modified or created since yesterday". This is the API Polling strategy.

Modern APIs offer an alternative strategy: being able to subscribe to changes and be notified quickly. This is the push strategy and the basis of webhooks.

Webhooks are based on an event system and use the HTTP protocol to transmit data. The nature of the events depends on the business logic of each application. For a CRM application, it is possible to subscribe to events such as "creation of a new contact", "modification of a contact", "deletion of a contact", etc.

The format of Webhooks is not standardised and there is no established specification. However, most players use the JSON format for data and apply security mechanisms or callback strategies (if our application is unavailable at the time of communication).

Here's a site I wish I'd discovered 4 years ago. It's a collection of best practices for Webhooks (security, documentation, examples, tests, operational) for both the sender and the customer/consumer:

It's still early days, but at SymfonyCon 2022, discussions are underway to create a component to simplify and standardise the management of Webhooks (more generically known as "Remote Events") in Symfony.

In conclusion, webhooks often make for smoother, faster integration, often generating simpler code (from the customer's point of view) and consuming less data on the network. How convenient!