



Have any questions? We’re here to help You
All Makini webhooks include a signature header for verification. The signature is an HMAC hash of the webhook payload using your webhook secret as the key. To verify a webhook, compute the HMAC using your secret and compare it to the signature header using constant-time comparison to avoid timing attacks. Never process webhook data without verification, as this could expose your system to forged requests. Your webhook secret is provided when you configure webhooks and should be stored securely. Webhook verification ensures that only legitimate requests from Makini are processed by your application.
Design your webhook receiver to handle duplicates and out-of-order webhooks, as network issues or retries can cause both scenarios. Keep the receiver lightweight—ideally writing incoming webhooks to a queue or reliable storage—then process them asynchronously. This prevents timeouts and allows your system to handle high-volume webhook spikes. Respond with a 200 status code immediately after receiving the webhook, before processing begins. Implement idempotency by tracking processed webhook IDs and skipping duplicates. Use constant-time comparison for signature verification to prevent timing attacks. If webhook processing fails, log the error but still return 200 to prevent unnecessary retries. Set up monitoring and alerts for webhook failures so you can investigate issues promptly. For critical workflows, combine webhooks with periodic polling as a fallback mechanism.
Makini supports create, read, update, and delete (CRUD) operations, though availability varies by system and entity type. Most systems support creating and updating core entities like purchase orders, work orders, and inventory items. Read operations are universally supported across all entity types. Delete operations are less commonly supported due to system constraints—many industrial systems use soft deletes or status changes rather than true deletion. Update operations may be limited to specific fields depending on system configuration and business rules. For example, some systems prevent modifying purchase orders after approval. We recommend validating specific operation support for your use case during the technical deep dive.
Disconnecting a connection can be done through the Makini dashboard or API. In the dashboard, navigate to the connection and select disconnect. Via API, call the disconnect endpoint with the connection ID. Disconnecting immediately invalidates the API token and stops all scheduled syncs and workflows for that connection. The connection credits used are returned to your pool and become available for new connections. Disconnecting does not delete historical data that was previously synced—that remains accessible until you choose to delete it. Customers can reconnect the same system at any time, which will create a new connection with a new API token. Use disconnection for customers who churn or when permanently retiring a connection.
