Webhook and subscription lab

This lab traces a Graph subscription through callback storage and dashboard display. Complete local setup and its Graph authorization prerequisites first.

Notification path

Create a subscription in the dashboard. Graph sends callbacks to /graphWebhook or /graphWebhook/lifecycle. The lab records request metadata, validates the envelope and trust fields, optionally decrypts rich content, and stores WebhookCall and WebhookEvent records.

Validation handshakes return the supplied validation token as plain text. Invalid JSON or shape can still produce a stored diagnostic call with HTTP 202. A callback response alone does not prove a trusted event or a canonical mailbox update.

Dashboard views

Subscriptions offers create, renew, and delete, with local versus remote state and active/expired/missing conditions. These actions change real Graph subscriptions.

Webhook Calls shows incoming requests, parse status, response status, event count, and event-level decryptionStatus/clientStateStatus. Subscription details show its timeline and lifecycle events.

Trust and decryption

Client-state checks use timing-safe comparison. A matching clientState gates rich-content decryption in this lab. Supplied validation tokens undergo checks, but their result is diagnostic only. INVALID, UNAVAILABLE, or NOT_PRESENT token status does not stop decryption when client state matches. Those token results also do not block every lifecycle update.

The decryption path unwraps a content key with RSA and checks HMAC integrity. It decrypts content and stores decryptedResourceJson when successful.

A mismatched client state skips rich-content decryption and retains diagnostic evidence. An invalid notification token alone does not prevent decrypted resource storage. This is weaker than the production ingress trust checks. Keep the lab database private because raw requests can contain sensitive information.

Dashboard authentication is disabled. Use a trusted local/development environment and expose only the callback required for the experiment. This is not a production internet-facing administrator UI.

Diagnose a subscription

Inspect remote validity, callback reachability, client-state status, certificate identity, and lifecycle events. Compare rich and plain arrivals separately. If a callback arrives without content changes, use delta reads to inspect provider state. Production uses its own durable webhook and delta path.