Table of Contents

Configure SESAR

Tell SESAR where to send each drop, and with which keys.

SESAR settings

SESAR setting Role In the webhook
WebHook HTTPS address of the webhook See Choose the address
WebHookKey Encryption key, in Base64 WebHookEncryptionKey in the secrets file
WebHookIv Initialization vector, in Base64 WebHookEncryptionIV in the secrets file
WebHook_Headers Optional HTTP headers, added to each request Not read by the webhook. A reverse proxy can use them: see Secure the deployment
PrivateAESKey Key of the files that SESAR encrypts on disk Required by the SharePoint connector only

SESAR calls the webhook only if WebHook, WebHookKey and WebHookIv are all three set. The key and the IV must be copied identically on both sides.

Choose the address

For Address
A handler, the recommended case https://<server>/api/webhook/handler/{id}
A built-in connector https://<server>/api/webhook/{id}
The default connector (DefaultConnectorId) https://<server>/api/webhook
The default handler (Connector:generic:DefaultHandlerId) https://<server>/api/webhook/generic

The routes that call several connectors or handlers at once (/api/webhook/multi, /api/webhook/handler/multi) always answer 200, even on failure: SESAR would therefore never send a badly processed drop again. Prefer one address per connector or handler.

What SESAR does for each drop

  • It sends a JSON POST, with the SESAR user agent, and waits 60 seconds at most for the response.
  • Only a 200 response counts as a confirmation. Any other response, or no response, makes SESAR send the drop again later.
  • It validates the webhook's certificate according to Windows rules: use a certificate issued by an authority that the SESAR machine trusts.

Consequences for your handler:

  • Finish in less than 60 seconds. Beyond that, SESAR considers the sending failed and will send it again, although your processing may have succeeded.
  • Accept duplicates. The same drop can arrive several times: identify it, for example by its tracking identifier (GetTrackingId), and process it only once.
  • Tell transient errors from permanent ones. A permanent error returned as a failure will be resent endlessly: log it and fix the cause.