Mautic Community Forums

What is the "raw payload body" in authenticity verification of webhooks?

Hello.
I have a problem with understanding what documentation means when it mentions “(raw) payload body” during HMAC verification:
https://developer.mautic.org/?json#authenticity-verification

I have a raw body like that:

{"mautic.lead_post_save_new":[{"contact":{"isPublished":true,"dateAdded":"2017-06-19T09:31:18+00:00","dateModified":null,"createdBy":1,"createdByUser":"John Doe","modifiedBy":null,"modifiedByUser":null,"id":52,"points":0,"color":null,"fields":{"core":{"timezone1":{"id":46,"group":"core","label":"timezone","alias":"timezone1","type":"timezone","value":"Europe\/Prague"},"datetime":{"id":45,"group":"core","label":"datetime","alias":"datetime","type":"datetime","value":""},"boolean":{"id":44,"group":"core","label":"boolean","alias":"boolean","type":"boolean","value":null},"f_select":{"id":43,"group":"core","label":"select","alias":"f_select","type":"select","value":null},"multiselect":{"id":42,"group":"core","label":"Multiselect","alias":"multiselect","type":"multiselect","value":"php|js"},"title":{"id":1,"group":"core","label":"Title","alias":"title","type":"lookup","value":"Mr."},"firstname":{"id":2,"group":"core","label":"First Name","alias":"firstname","type":"text","value":"John"},"lastname":{"id":3,"group":"core","label":"Last Name","alias":"lastname","type":"text","value":"Doe"},"company":{"id":4,"group":"core","label":"Company","alias":"company","type":"text","value":null},"position":{"id":5,"group":"core","label":"Position","alias":"position","type":"text","value":null},"email":{"id":6,"group":"core","label":"Email","alias":"email","type":"email","value":"john@doe.name"},"mobile":{"id":7,"group":"core","label":"Mobile","alias":"mobile","type":"tel","value":null},"phone":{"id":8,"group":"core","label":"Phone","alias":"phone","type":"tel","value":null},"fax":{"id":9,"group":"core","label":"Fax","alias":"fax","type":"tel","value":null},"address1":{"id":10,"group":"core","label":"Address Line 1","alias":"address1","type":"text","value":null},"address2":{"id":11,"group":"core","label":"Address Line 2","alias":"address2","type":"text","value":null},"city":{"id":12,"group":"core","label":"City","alias":"city","type":"text","value":"Prague"},"state":{"id":13,"group":"core","label":"State","alias":"state","type":"region","value":null},"zipcode":{"id":14,"group":"core","label":"Zip Code","alias":"zipcode","type":"text","value":"16000"},"country":{"id":15,"group":"core","label":"Country","alias":"country","type":"country","value":"Czech Republic"},"preferred_locale":{"id":16,"group":"core","label":"Preferred Locale","alias":"preferred_locale","type":"locale","value":"cs_CZ"},"attribution_date":{"id":17,"group":"core","label":"Attribution Date","alias":"attribution_date","type":"datetime","value":"2017-06-14 11:30:00"},"attribution":{"id":18,"group":"core","label":"Attribution","alias":"attribution","type":"number","value":32},"website":{"id":19,"group":"core","label":"Website","alias":"website","type":"url","value":null}},"social":{"facebook":{"id":20,"group":"social","label":"Facebook","alias":"facebook","type":"text","value":null},"foursquare":{"id":21,"group":"social","label":"Foursquare","alias":"foursquare","type":"text","value":null},"instagram":{"id":23,"group":"social","label":"Instagram","alias":"instagram","type":"text","value":null},"linkedin":{"id":24,"group":"social","label":"LinkedIn","alias":"linkedin","type":"text","value":null},"skype":{"id":25,"group":"social","label":"Skype","alias":"skype","type":"text","value":null},"twitter":{"id":26,"group":"social","label":"Twitter","alias":"twitter","type":"text","value":null}},"personal":[],"professional":[]},"lastActive":null,"owner":{"createdByUser":null,"modifiedByUser":null,"id":1,"username":"admin","firstName":"John","lastName":"Doe"},"ipAddresses":[],"tags":[[]],"utmtags":null,"stage":null,"dateIdentified":"2017-06-19T09:31:18+00:00","preferredProfileImage":"gravatar","doNotContact":[],"frequencyRules":[]},"timestamp":"2017-06-19T09:31:18+00:00"}],"mautic.lead_post_save_update":[{"contact":{"isPublished":true,"dateAdded":"2017-06-19T09:31:18+00:00","dateModified":"2017-06-19T09:32:24+00:00","createdBy":1,"createdByUser":"John Doe","modifiedBy":1,"modifiedByUser":"John Doe","id":52,"points":0,"color":null,"fields":{"core":{"title":{"id":"1","label":"Title","alias":"title","type":"lookup","group":"core","object":"lead","is_fixed":"1","value":"Mr."},"firstname":{"id":"2","label":"First Name","alias":"firstname","type":"text","group":"core","object":"lead","is_fixed":"1","value":"John"},"lastname":{"id":"3","label":"Last Name","alias":"lastname","type":"text","group":"core","object":"lead","is_fixed":"1","value":"Doe"},"company":{"id":"4","label":"Company","alias":"company","type":"text","group":"core","object":"lead","is_fixed":"1","value":"Mautic"},"position":{"id":"5","label":"Position","alias":"position","type":"text","group":"core","object":"lead","is_fixed":"1","value":null},"email":{"id":"6","label":"Email","alias":"email","type":"email","group":"core","object":"lead","is_fixed":"1","value":"john@doe.name"},"mobile":{"id":"7","label":"Mobile","alias":"mobile","type":"tel","group":"core","object":"lead","is_fixed":"1","value":"333444555"},"phone":{"id":"8","label":"Phone","alias":"phone","type":"tel","group":"core","object":"lead","is_fixed":"1","value":null},"fax":{"id":"9","label":"Fax","alias":"fax","type":"tel","group":"core","object":"lead","is_fixed":"0","value":null},"address1":{"id":"10","label":"Address Line 1","alias":"address1","type":"text","group":"core","object":"lead","is_fixed":"1","value":null},"address2":{"id":"11","label":"Address Line 2","alias":"address2","type":"text","group":"core","object":"lead","is_fixed":"1","value":null},"city":{"id":"12","label":"City","alias":"city","type":"text","group":"core","object":"lead","is_fixed":"1","value":"Prague"},"state":{"id":"13","label":"State","alias":"state","type":"region","group":"core","object":"lead","is_fixed":"1","value":null},"zipcode":{"id":"14","label":"Zip Code","alias":"zipcode","type":"text","group":"core","object":"lead","is_fixed":"1","value":"16000"},"country":{"id":"15","label":"Country","alias":"country","type":"country","group":"core","object":"lead","is_fixed":"1","value":"Czech Republic"},"preferred_locale":{"id":"16","label":"Preferred Locale","alias":"preferred_locale","type":"locale","group":"core","object":"lead","is_fixed":"1","value":"cs_CZ"},"attribution_date":{"id":"17","label":"Attribution Date","alias":"attribution_date","type":"datetime","group":"core","object":"lead","is_fixed":"1","value":"2017-06-14 11:30:00"},"attribution":{"id":"18","label":"Attribution","alias":"attribution","type":"number","group":"core","object":"lead","is_fixed":"1","value":32},"website":{"id":"19","label":"Website","alias":"website","type":"url","group":"core","object":"lead","is_fixed":"0","value":null},"multiselect":{"id":"42","label":"Multiselect","alias":"multiselect","type":"multiselect","group":"core","object":"lead","is_fixed":"0","value":"php|js"},"f_select":{"id":"43","label":"select","alias":"f_select","type":"select","group":"core","object":"lead","is_fixed":"0","value":null},"boolean":{"id":"44","label":"boolean","alias":"boolean","type":"boolean","group":"core","object":"lead","is_fixed":"0","value":null},"datetime":{"id":"45","label":"datetime","alias":"datetime","type":"datetime","group":"core","object":"lead","is_fixed":"0","value":""},"timezone1":{"id":"46","label":"timezone","alias":"timezone1","type":"timezone","group":"core","object":"lead","is_fixed":"0","value":"Europe\/Prague"}},"social":{"facebook":{"id":"20","label":"Facebook","alias":"facebook","type":"text","group":"social","object":"lead","is_fixed":"0","value":null},"foursquare":{"id":"21","label":"Foursquare","alias":"foursquare","type":"text","group":"social","object":"lead","is_fixed":"0","value":null},"instagram":{"id":"23","label":"Instagram","alias":"instagram","type":"text","group":"social","object":"lead","is_fixed":"0","value":null},"linkedin":{"id":"24","label":"LinkedIn","alias":"linkedin","type":"text","group":"social","object":"lead","is_fixed":"0","value":null},"skype":{"id":"25","label":"Skype","alias":"skype","type":"text","group":"social","object":"lead","is_fixed":"0","value":null},"twitter":{"id":"26","label":"Twitter","alias":"twitter","type":"text","group":"social","object":"lead","is_fixed":"0","value":null}},"personal":[],"professional":[]},"lastActive":null,"owner":{"createdByUser":null,"modifiedByUser":null,"id":1,"username":"admin","firstName":"John","lastName":"Doe"},"ipAddresses":[],"tags":[[]],"utmtags":[],"stage":null,"dateIdentified":"2017-06-19T09:31:18+00:00","preferredProfileImage":"gravatar","doNotContact":[],"frequencyRules":[]},"timestamp":"2017-06-19T09:32:24+00:00"}],"timestamp":"2021-04-14T12:04:30+00:00"};

with secret zzzazz and signature Dl7f5cvwZzMKL6JJRSyDWdycp/JWJr0LCAfkqxPqPFs=

The generated signature is IXiLxrthxSLyrsB3NZaaPB2mfXkdEncbcM+FAwbaj+g=

I tried calculating this with php:
base64_encode(hash_hmac('sha256', $message, $secret, true));

and java:
public String hmac(final String secret, final String message) {
Mac sha256HMAC;
try {
final byte byteKey = secret.getBytes(StandardCharsets.UTF_8);
sha256HMAC = Mac.getInstance(HMAC_SHA256);
SecretKeySpec keySpec = new SecretKeySpec(byteKey, HMAC_SHA256);
sha256HMAC.init(keySpec);
byte macData = sha256HMAC.doFinal(message.getBytes(StandardCharsets.UTF_8));
return Base64.getEncoder().encodeToString(macData);
} catch (InvalidKeyException | NoSuchAlgorithmException e) {
e.printStackTrace();
}
return null;
}

Results are however the same, the generated signature never match.
Can I ask what exactly “raw payload body” is?

EDIT:
It seems that block of preformatted text is not working

For anyone having the same issue, the reason is pretty simple.
The “Send Test Payload” for some reason does not use correct secret and I tried verifying based on that test payload. After configuring the webhook and triggering the real event, it is verified correctly(however “Send Test Payload” still does not work).