Webhooks & SSO
Webhooks push events out of EduPrime the moment they happen, and Single Sign-On lets staff and students log in with your existing identity provider – two integrations that keep external systems in step and access centrally controlled.
Subscribing to events
Rather than polling the API, subscribe to webhooks – EduPrime sends an HTTP POST to your endpoint whenever a subscribed event occurs. Configure them under Settings → API & Integrations → Webhooks.
| Event | Fires when |
|---|---|
student.enrolled | A student is admitted to a programme |
invoice.paid | A fee invoice is fully paid |
result.published | Results are released for a cohort |
application.submitted | An online application is received |
certificate.issued | A short-course or competency certificate is issued |
- Register a callback URL (HTTPS only) and select the events to receive.
- EduPrime POSTs a JSON payload with the event type, timestamp and the relevant record.
- Respond 2xx quickly to acknowledge; do heavy work asynchronously.
- Failed deliveries are retried with backoff; persistent failures are queued for inspection.
Signature verification
Because a webhook endpoint is a public URL, you must verify each delivery genuinely came from EduPrime. Every POST carries an X-EduPrime-Signature header – an HMAC of the raw request body computed with your webhook signing secret.
- Take the raw request body (bytes, before parsing).
- Compute
HMAC-SHA256(body, signing_secret). - Compare it to the header value using a constant-time comparison.
- Reject the request if they do not match, or if the timestamp is too old (replay protection).
Single sign-on
SSO lets users authenticate through your institution’s identity provider rather than a separate EduPrime password. EduPrime supports the common enterprise protocols:
- OpenID Connect (OIDC) – OAuth 2.0-based; the typical choice for Google Workspace and Microsoft Entra ID.
- SAML 2.0 – for identity providers and federations that standardise on SAML.
With SSO, joiners and leavers are managed centrally: disable an account in the IdP and access to EduPrime ends with it. You can map IdP groups to EduPrime roles so a user’s permissions follow their directory group.