Skip to main content
PRESS — Network Flow
The diagram above shows how events flow end-to-end — from ICP source systems through the PRESS engine, across the secure network, and into your webhook endpoint. Use it as a reference while setting up your integration.

​
What You Need to Provide

To start receiving PRESS events, provide the following during onboarding:
ItemDescription
Webhook URLYour HTTPS endpoint that will receive events (e.g., https://api.yourdomain.ae/webhooks/press). Must support POST requests.
Static IPYour server’s public IP address. ICP whitelists this for secure connectivity.
Event SubscriptionsWhich events you want to receive. You can subscribe to all or a subset. See Lifecycle Events.
Technical ContactEmail address of the person responsible for implementing and maintaining the webhook integration.
Support ContactEmail address for incident and operational communication.

​
What ICP Returns

Once onboarding is complete, you receive:
ItemDescription
HMAC Signing SecretA unique secret key prefixed whsec_ used to verify every incoming webhook request. Download it from the UAE KYC client dashboard.
Subscription IDYour unique webhook subscription identifier. Included in every delivery header.
Sandbox CredentialsA separate secret and subscription for testing before going live.
Never log, commit to source control, or share your signing secret. Store it in a vault or secure environment variable.

​
Endpoint Requirements

Your webhook endpoint must:
  • Serve over HTTPS (TLS 1.3 only). HTTP is not supported.
  • Accept POST requests.
  • Accept Content-Type: application/cloudevents+json.
  • Be reachable from the ICP webhook delivery service.
  • Respond with HTTP 200 within 500 milliseconds.
  • Not depend on redirects — ICP does not follow 3xx.
  • Not require interactive login or authentication challenges.
Accept the event, store it, and return 200 immediately. Process business logic asynchronously in a background worker.

​
Security

​
IP Whitelisting

DirectionWhat is whitelisted
ICP → YouICP shares their source IP with you. Whitelist it on your firewall or load balancer so you only accept traffic from ICP.
You → ICPYour static IP is whitelisted at ICP. Only traffic to your whitelisted IP will be serviced.

​
HMAC Signature

Every webhook delivery includes an X-Webhook-Signature header. This is an HMAC-SHA256 signature computed over the request body using your signing secret. You must verify this on every request. See Signature Verification for the full verification guide and code examples.

​
Sandbox Checklist

Complete all of these before requesting production activation:
Send test events from sandbox and confirm your endpoint parses all event types without errors.
Deliberately send a request with a bad signature and confirm your endpoint rejects it with 401.
Reject requests where the X-Webhook-Timestamp is older than 5 minutes. Ensure your server clock is synchronised via NTP — clock drift will cause valid requests to be incorrectly rejected.
Process the same X-Webhook-Id twice and confirm the event is not processed twice.
Confirm under normal load your endpoint returns 200 well within the timeout.
ICP may add new optional fields in future versions. Your parser must not fail on unknown fields.
Your endpoint stores the event and returns 200 before running any downstream processing.

​
Pause vs Cancel

ActionWhat happensReversible?
PauseTemporarily stops delivery. Can be resumed.Yes
CancelPermanently terminates the webhook subscription.No
If you need a temporary stop (maintenance, migration), request a pause. Events during a pause are not queued unless explicitly arranged with ICP.