Availability and Rates APIs
Booking APIs
Property Mgmt APIs
Notifications (webhooks)
ReferenceNotifications (webhooks)

createNotificationCallbackConfig mutation

Creates the callback configuration for the lodging partner account, including the following:

  • Callback URL (where notification events are sent when they occur)
  • API key
  • Partner email address (where secret expiry warnings are sent)
  • Request timeout value.

If the partner's notification profile does not exist, this mutation will create the profile, too.

Note: Immediately after registering the callback URL, we send a GET request to your endpoint, to check connectivity from the Expedia network and verify whether the URL is whitelisted. This is issued once and can be ignored.

When creating the callback configuration, the API generates a secret along with its expiration date and time, which are returned in the mutation response. You can use the secret to validate the signature of payloads when you receive notifications from the webhooks service.

By default, the secret is valid for one year. You can determine when it will expire using the secretExpirationDateTime field; we recommend that you renew the secret at least 30 days before the expiry date. If the secret expires, notifications fail to be sent for active subscriptions, though we attempt to retry sending them (according to the retry policy for the event type). If the secret is refreshed during these retry attempts, notifications are sent successfully. After the secret is refreshed, you have up to three days to replace the old secret (as specified when refreshing the secret).

The following is passed in the HTTP headers of the notification:

  • API key.
  • Timestamp, in epoch time.
  • Signature, in this format: sha256=hash(timestamp.notification_payload). This is a Base64-encoded HMAC-SHA256 hash of the timestamp and notification payload using the secret as the key. If the old secret is still active, the format is sha256=hash(timestamp.notification_payload) with newSecret,hash(timestamp.notification_payload) with oldSecret. Note that you must code for comma-delimiting hashes in both cases.

Here is an example of the headers for a MessageAttributesUpdated notification: 

1"transactionId": "11111111-1111-11ec-97a3-5d06cc689918" 
2"api-key": "apiKey" 
3"x-eg-notification-timestamp": "1674149042995" 
4"x-eg-notification-signature-v2": "sha256=hash(1732710561482.{"event_name":"MessageAttributesUpdated","creation_time":"2024-11-28T10:27:18.212Z","notification_id":"53c7cb70-d772-4ddd-ad04-b1fcae1620c8","payload":{"property_id":"11840519","message_thread_id":"46c35257-1e78-45c0-a64d-cc5fae75d007","message_id":"20aeeade-0bf4-48f2-8c8b-9cda524551a9","from_role":"SUPPLIER","reservation_id":"368177214","message_attributes":[{"attribute":"reviewStatus","value":"ACCEPTED"}]}}, WUsM9s+yTDln9AfZVVAY+g==)"

Syntax

1mutation { 
2  createNotificationCallbackConfig(
3    input: CreateNotificationCallbackConfigInput!
4  ): CreateNotificationCallbackConfigPayload
5}

Example

1mutation {
2  createNotificationCallbackConfig (
3    input: {
4      callbackUrl : "https://testcallbackurl.com",
5      apiKey : "newapikey",
6      requestTimeoutSeconds: 10,
7      contactEmail: "partner@email.com"
8    }
9  ) {
10    callbackConfig {
11      id
12      callbackUrl
13      secretExpirationDateTime
14      requestTimeoutSeconds
15      contactEmail
16    }
17    secret
18  }
19}

Arguments

NameDescription

input

Required.

Details used when creating the callback configuration.

Type: CreateNotificationCallbackConfigInput

Types


Name
Type
CreateNotificationCallbackConfigInput
InputObject

Details about the callback configuration.

FieldDescription
apiKeyNot nullable.

Key used to authenticate requests. The key is a UTF-8 encoded string (no size limit).

Type: String
callbackUrlNot nullable.

Callback URL (REST endpoint) where real-time events are sent.

Type: Url
contactEmailNot nullable.

Email address where a notification is sent when the callback configuration's secret is about to expire. We recommend specifying an email distribution list instead of an individual's address because addresses can become obsolete, increasing the risk of expiry secrets not being reset in time. The email notification is sent 30 days, 7 days, and 1 days prior to expiration.

Type: EmailAddress
requestTimeoutSeconds

Amount of time (in seconds) we wait for the partner to respond when a notification is sent to them. If a response is not received within request timeout time, the notification is retried according to the retry policy. Specify values between 1-10. We recommend that the partner responds in less than five seconds, though less than one second is ideal. If this argument is not set, the default is three seconds (though this field will still show null).

Type: Int
CreateNotificationCallbackConfigPayload
Object

Details about the callback configuration returned by the mutation.

FieldDescription
callbackConfigNot nullable.

Details about the callback configuration.

Type: NotificationCallbackConfig
secretNot nullable.

String (24 characters in length) used to validate the signature of payloads when you receive notifications from the webhooks service. By default, the secret is valid for one year (no notification is sent when the secret expires; you can determine when it will expire using the secretExpirationDateTime field).

Type: String
EmailAddress
EmailAddress

A field whose value conforms to the standard internet email address format as specified in HTML Spec.

ID
ID

The ID scalar type represents a unique identifier, often used to refetch an object or as key for a cache. The ID type appears in a JSON response as a String; however, it is not intended to be human-readable. When expected as an input type, any string (such as "4") or integer (such as 4) input value will be accepted as an ID.

Int
Int

The Int scalar type represents non-fractional signed whole numeric values. Int can represent values between -(2^31) and 2^31 - 1.

LocalDateTime
LocalDateTime

A type representing a date and time (such as 2007-12-03T10:15:30).

NotificationCallbackConfig
Object

Details about the callback configuration.

FieldDescription
callbackUrlNot nullable.

Callback URL (REST endpoint) where real-time events are sent.

Type: Url
contactEmail

Email address where a notification is sent when the callback configuration's secret is about to expire. The email notification is sent 30 days, 7 days, and 1 days prior to expiration.

Type: EmailAddress
idNot nullable.

ID of the callback configuration.

Type: ID
requestTimeoutSecondsNot nullable.

Amount of time (in seconds) we wait for the partner to respond when a notification is sent to them. If a response is not received within request timeout time, the notification is retried according to the retry policy.

Type: Int
secretExpirationDateTimeNot nullable.

Expiration date and time for the secret.

Type: LocalDateTime
String
String

The String scalar type represents textual data, represented as UTF-8 character sequences. The String type is most often used by GraphQL to represent free-form human-readable text.

Url
Url

Scalar type whose value conforms to the standard URL format as specified in RFC3986 specification.