The UCP specification (specifically in rest.openapi.json under webhooks.orderEvent) requires the following headers to be sent with the orderEvent webhook:
Webhook-Timestamp: Webhook event occurrence unix timestamp (seconds since epoch).Webhook-Id: The unique identifier of a webhook event (UUID).
Currently, neither the Python server (rest/python/server/services/checkout_service.py) nor the Node.js server (rest/nodejs/src/api/checkout.ts) sends these headers. They only send a custom X-Event-Type header.
We should update both implementations to generate and send these spec-mandated headers:
- Generate a unique UUID for
Webhook-Id for each event.
- Generate the current Unix timestamp for
Webhook-Timestamp.
- Include these headers in the POST request to the webhook URL.
- Update the corresponding integration tests to assert these headers are present and have correct formats.
This will ensure the sample implementations are fully compliant with the UCP webhook specification.
The UCP specification (specifically in
rest.openapi.jsonunderwebhooks.orderEvent) requires the following headers to be sent with theorderEventwebhook:Webhook-Timestamp: Webhook event occurrence unix timestamp (seconds since epoch).Webhook-Id: The unique identifier of a webhook event (UUID).Currently, neither the Python server (
rest/python/server/services/checkout_service.py) nor the Node.js server (rest/nodejs/src/api/checkout.ts) sends these headers. They only send a customX-Event-Typeheader.We should update both implementations to generate and send these spec-mandated headers:
Webhook-Idfor each event.Webhook-Timestamp.This will ensure the sample implementations are fully compliant with the UCP webhook specification.