Test Autodesk Platform Services webhooks locally

Receive Autodesk Platform Services (APS) webhook events on your laptop while you build, with a public HTTPS URL APS can reach.

Horizon has no Autodesk integration. The APS Webhooks service sends events to a public URL, and Horizon provides that URL. APS has no dashboard page for webhooks. You register them through the Webhooks API.

Before you beginCopy Anchor Link

• Node.js 18 or later
• A Horizon account and the CLI (see Getting started)
• A reserved subdomain for -s. Reserve one on the Subdomains page.
• An APS app, and an access token with the data:read and data:write scopes
• A Next.js app that uses the App Router and runs on port 3000

import { createHmac, timingSafeEqual } from "node:crypto";

export async function POST(request: Request) {
  const secret = process.env.APS_WEBHOOK_SECRET;
  if (!secret) {
    return new Response("Missing APS_WEBHOOK_SECRET", { status: 500 });
  }

  const body = await request.text();
  const received = request.headers.get("x-adsk-signature") ?? "";
  const expected = `sha1hash=${createHmac("sha1", secret).update(body).digest("hex")}`;

  const receivedBuffer = Buffer.from(received);
  const expectedBuffer = Buffer.from(expected);
  const isValid =
    receivedBuffer.length === expectedBuffer.length &&
    timingSafeEqual(receivedBuffer, expectedBuffer);

  if (!isValid) {
    return new Response("Invalid signature", { status: 401 });
  }

  console.log("Received APS webhook:", body);

  return new Response("ok", { status: 200 });
}

APS_WEBHOOK_SECRET=replace-with-a-32-to-64-character-alphanumeric-string

npm run dev

hrzn tunnel http://localhost:3000 -s my-aps-app

HORIZON: Tunnel connected
  URL          https://my-aps-app.hrzn.run (reserved)
  Forwarding   http://localhost:3000
  Request log  https://hrzn.run/dashboard/tunnels/my-aps-app

curl -X POST "https://developer.api.autodesk.com/webhooks/v1/tokens" \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{ "token": "replace-with-a-32-to-64-character-alphanumeric-string" }'

curl -X POST "https://developer.api.autodesk.com/webhooks/v1/systems/data/events/dm.version.added/hooks" \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "callbackUrl": "https://my-aps-app.hrzn.run/api/webhooks/autodesk",
    "scope": { "folder": "<FOLDER_URN>" }
  }'

Check it worksCopy Anchor Link

After you add a version to the folder, the Horizon terminal prints one line:

  POST    200  /api/webhooks/autodesk

Your app terminal prints the payload as Received APS webhook: {...}.

If the line shows [401], see Troubleshooting.

TroubleshootingCopy Anchor Link

The signature doesn't matchCopy Anchor Link

The Horizon line shows [401]. Check these in order:

• APS_WEBHOOK_SECRET is exactly the token you sent to POST /webhooks/v1/tokens. Restart npm run dev after you edit .env.local.
• The handler hashes the raw body from request.text(). Parsing the JSON first and hashing the object gives a different value.
• You compare against sha1hash= followed by the hex digest, not the digest alone.

There is no x-adsk-signature headerCopy Anchor Link

You didn't register a secret token, or the token call failed. Send the token to POST /webhooks/v1/tokens and check for a success response.

The hook stops deliveringCopy Anchor Link

APS retries a failed callback four times, and the last retry is at least 48 hours after the first attempt. If the last retry fails, APS disables the hook. A failure is a non-2xx status, or no response within 6 seconds. Fix the handler, then create or reactivate the hook.

The URL changed after a restartCopy Anchor Link

You started the tunnel without -s, so Horizon gave you a new random subdomain. The hook still calls the old URL. Restart with -s my-aps-app, and create the hook again if the URL differs.

Next stepsCopy Anchor Link

• Read APS's guide to verifying the payload signature.
• See the Webhooks API reference for other systems and events.
• Reserve a subdomain so your URL never changes: see pricing.