Parse and validate merchant webhook payloads
Last updated: August 6, 2025
Quick Overview
Design a function that parses and validates merchant webhook payloads by verifying HMAC signatures and extracting relevant information from JSON payloads based on specified event types. The function should return structured event objects if the payload is valid, or an error message if validation fails. Ensure that the implementation handles various event types with their required fields appropriately.
Affirm
August 6, 202510
11
2,803 solved
Design a function that parses and validates merchant webhook payloads by verifying HMAC signatures and extracting relevant information from JSON payloads based on specified event types. The function should return structured event objects if the payload is valid, or an error message if validation fails. Ensure that the implementation handles various event types with their required fields appropriately.
Webhook processing is a daily task at Affirm. This problem tests your ability to write defensive code that handles untrusted input, validates security signatures, and processes different event types cleanly in Python.
What the Interviewer Expects
- Implement HMAC-SHA256 signature verification correctly
- Parse JSON payloads defensively with proper error handling for malformed input
- Use a clean pattern to handle multiple event types (factory or registry pattern)
- Validate required fields per event type and return clear error messages
- Write code that is secure against common webhook vulnerabilities
Key Topics to Cover
How to Approach This
- Clarify input constraints and edge cases before writing code.
- Walk through your approach verbally and confirm with the interviewer before coding.
- Start with a brute force solution, then optimize. Mention time and space complexity.
- Test your solution with examples, including edge cases like empty input or duplicates.
- Consider common patterns: sliding window, two pointers, hash map, BFS/DFS, dynamic programming.
Possible Follow-up Questions
- How would you protect against replay attacks using webhook timestamps?
- How would you handle webhook payload schema versioning?
- What if the same webhook is delivered twice? How do you ensure idempotent processing?
- How would you handle a webhook event type that your system does not recognize?
Sharpen Your Skills on Codemia
Practice similar problems with our interactive workspace, get AI feedback, and track your progress.
Practice DSA ProblemsSample Answer
Problem Analysis
The problem requires parsing and validating webhook payloads from merchants by verifying HMAC signatures and extracting relevant event information from JSON. This involves multiple components: signatu...
Approach
- HMAC Signature Verification: Use HMAC with SHA-256 to verify the signature against the payload. This ensures that the payload wasn't tampered with.
- Parse JSON Payload: Safely parse the...
Submit Your Answer
