Uber Developers

UCLID Notification

WEBHOOK: POSThttps://<YOUR_WEBHOOK_URI> event_type: orders.trips.uclid-info

Privileged and Confidential This endpoint design has been confidentially shared with you. It is still under development and is subject to change without notice. Please do not share this document or API endpoint details with anyone who is not authorized to have access. For more information read about scopes.

Event indicating that a trip has been created with linked UCLID (Uber Click ID).

¶ Retry Attempts

If for some reason the Uber API cannot reach the webhook URL you specified either due to networking issues or application issues on your end, the webhooks service will retry to make a request.

We have implemented an exponential back-off algorithm with a back-off multiplier of 30 seconds which will make up to 7 attempts. This means we will attempt to request your webhook URL up to 7 times across roughly 1 hour.

¶ Webhook Headers

The Uber API will insert specialized headers for all requests made to your webhook URL to help your application utilize them appropriately.

Header	Description
`X-Environment`	Indicates if this request is coming from the `production` or `sandbox` API.
`X-Uber-Signature`	SHA256 hash of the request body, computed using the app’s signing key as the key.

¶ Webhook Security

Webhook messages are signed so that your app can verify that the sender is Uber. Webhooks requests contain an X-Uber-Signature header. The value of this field is a hexadecimal HMAC signature of the webhook HTTP request body, using app’s signing key as the key and SHA256 as the hash function.

Python Example

digester = hmac.new(signing_key, webhook_body, hashlib.sha256)
return digester.hexdigest()

Due to a strict interpretation of the JSON specification by JavaScript, if there are backslashes sent in the POST body, they will be removed upon parsing. This prevents webhook receivers implemented in NodeJS from verifying the webhook signature accurately. We are working on removing all backslashes from the payload in order to avoid this situation and will remove this note when that work is done.

¶ Authorization

You will get trip events if you have access token granted for consumers.trips.authcode authcode scope.

¶ Webhook Event Structure

Name	Type	Description
`order_id`	`string`	Unique UUID identifying the created trip.
`uclid`	`string`	External reference identifier (UUIDv4) which was sent by external partners while creating the trip.
`user_detail`	`object`	Object containing user detail.
`user_detail.user_id`	`string`	Rider ID for whom this trip is created.
`webhook_meta`	`object`	Object containing additional information that is specific to the `webhook`.
`webhook_meta.client_id`	`string`	Client ID for the developer.
`webhook_config_id`	`string`	Unique identifier of the webhook type.
`webhook_msg_timestamp`	`integer`	Unix timestamp of the time the webhook event was pushed.
`webhook_msg_uuid`	`string`	Unique identifier, which can be used to ensure that the webhooks are digested only once.

¶ Example Webhook

{
    "order_id": "6148a58a-2977-40ee-95db-070ef2af20d5",
    "uclid": "f3de37c0-6fea-4d23-85f7-e71b0b6db110",
    "user_detail": {
        "user_id": "8Zqm9wiZox6RKkYlG8RCYDUAtRarZVpWMLxzZHRykH1sGu0jlQ8vp9G0Jr52D81kZNdqP5NZ1upbzx-cZf892tHYnE3Wp7U8yT2YZV6sA1z8dygxxbaUiKojc2wzgNlL4g=="
    },
    "webhook_meta" : {
        "client_id": "8UeUmcctZb_HiryB1L5G-ytquIjJy8II",
    },
    "webhook_config_id": "orders.trips.uclid-info",
    "webhook_msg_timestamp": 1694783341,
    "webhook_msg_uuid": "fd56bd1a-233c-4d91-8a76-466b14358cbd"
}