# Application lifecycle webhooks

Outreach allows for registering a webhook URL for getting notifications about lifecycle events of your application.
To configure webhooks add the "Application lifecycle webhooks" feature to your app and specify the URL which is going to be called.

![Configuring application lifecycle webhooks](/assets/webhook-config.00b68f99b7fec0b93cb4feb991abc6438370549918f04f4febf4c269edf9f11c.9c1bb791.png)

Every time your application is installed, updated or reconfigured by an Outreach organization, your webhook will be called with the following payload:


```json
{
  "data": {
    "type": "install",
    "id": "INSTALL_ID",
    "relationships": {
      "app": {
        "data": {
          "type": "app",
          "id": "S2S_GUID"
        }
      }
    }
  },
  "meta": {
    "deliveredAt": "2019-01-01T00:00:00",
    "eventName": "install.created"
  }
}
```

When uninstalled, the value of `eventName` will be `install.deleted`.
When calling webhooks Outreach will set the following additional HTTP headers:

| Header | Description |
|  --- | --- |
| Content-Type | `application/vnd.api+json` |
| Outreach-Webhook-ID | UUID generated specifically for this request. |
| Outreach-Webhook-Signature | HMAC digest of the request body and your specified webhooks secret. See below for information on how to calculate this signature. |


## Validating webhook requests

To validate webhook requests calculate the SHA256 HMAC and compare it with the value of `Outreach-Webhook-Signature` header.
Outreach calculates this value as follows:


```ruby
OpenSSL::HMAC.hexdigest(
  OpenSSL::Digest.new("sha256"),
  OUTREACH_WEBHOOK_SECRET,
  request_body
```

You can find the `OUTREACH_WEBHOOK_SECRET` value in the webhook configuration page.