Receive Masnet events in Azure Logic Apps and Power Automate

Requirements in Masnet

Before configuring the receiving system, prepare the destination in Masnet. The steps are the same for every system.

1. Open Company › Integrations (the Spanish interface labels it Empresa › Integraciones), go to the Destinations tab and select New destination. If the integration has no authorized data yet, Masnet asks you to authorize it first.
2. In Destination address (https) enter the receiver public URL. It must be https, port 443 or 8443 and a public DNS name: user information in the URL, fragments, IP addresses and internal names are not accepted. A query string is allowed; Masnet treats the whole URL as a credential.
3. In Format choose Standard JSON (application/json) or Structured CloudEvents (application/cloudevents+json). The event content is the same; see Webhooks.
4. Select Create destination. Masnet shows the signing secret (whsec_…) only once. Store it immediately in the receiver secret store; it cannot be read again.
5. Select Test destination and then Send test. The integration is activated only after a successful test; then use Activate destination.

Flow configuration

1. In Logic Apps, create a flow with the Request trigger (called "When a HTTP request is received" in the documentation). Power Automate offers an equivalent HTTP request trigger.
2. Leave the method as POST (the default) and the body JSON schema empty, or generate it from a sample event on Events.
3. Save the flow. The HTTP URL box shows the callback URL, with query parameters that include sig= (shared access signature).
4. Copy that full URL and enter it in Destination address (https) in Masnet. Masnet allows query strings, encrypts the full URL as a secret, shows only the host and path in the interface with the query masked, and does not record it in logs or metrics.
5. Treat the URL as a credential: do not paste it into tickets or repositories. If it is exposed, regenerate the flow access key in Azure and update the destination address in Masnet.

Signature verification

The signature is v1, followed by base64(HMAC-SHA256) computed with the binary key obtained by base64-decoding what follows whsec_, over the bytes webhook-id + . + webhook-timestamp + . + the exact body. Always verify over the received bytes, before parsing the JSON.

The Logic Apps designer interprets the JSON body before you can access it, so rebuilding it with an expression may produce bytes different from those signed. To avoid this, call from the flow an Azure function (HTTP trigger) or a service of your own that receives the body uninterpreted, forwarding the three webhook-* headers, and that uses the verification of Node.js, Python, Java or C#.

With the Structured CloudEvents format the content type is application/cloudevents+json; per the Logic Apps documentation, content that is not application/json is treated as a single binary unit. Check in your flow which of the two formats delivers the unaltered bytes.

Useful trigger expressions (illustrative):

// Idempotency key (Request trigger outputs)
triggerOutputs()['headers']['webhook-id']

// Event type
triggerOutputs()['headers']['masnet-event-type']

// Event data (the JSON body, parsed by the designer)
triggerBody()?['data']?['object']

Response

If the flow does not include a Response action, the endpoint answers immediately with 202 Accepted, which Masnet considers a success. If you add a Response action, use code 200 or 202 after verifying the signature, and 401 if it is invalid; Azure does not allow 3xx codes in that action. If the response takes longer than the Azure time-out limit, the caller receives 408, and Masnet cuts the request at 15 seconds anyway.

Testing with the test event

1. In Masnet, select Test destination and Send test.
2. In the flow run history, open the run and check that masnet-event-type is com.masnet.integration.test.v1.
3. Activate the destination only after a successful test.

Operation: duplicates and ordering

• Idempotency. webhook-id identifies the event and is kept across retries and redeliveries. Record the identifiers already processed and discard repeats with a 2xx response.
• Ordering. Each resource (subject) carries an increasing sequence. Discard an event whose sequence is lower than or equal to the last one applied for that subject. Events of different resources have no order between them.
• Retries. Masnet retries any non-2xx response for up to 72 hours; the full schedule is in Webhooks.
• Secret rotation. When rotating with overlap, the previous secret stays valid for 24 hours and webhook-signature carries two v1,… signatures separated by a space. Accept the event if either one matches.

Troubleshooting

Masnet records the response code of each attempt in the delivery history. These are the effects of each receiver response: