Employment Hero Webhook Receiver
Turn inbound people platform events into signed, deduplicated, queued sync work for Odoo 18, without polling.
Store price is USD 132 all-in: installing this also pulls the 3 paid ERP Heritage modules it depends on.
Why this module
Employment Hero Webhook Receiver
Only genuine events get in
Every delivery is checked against the connection secret with a constant time HMAC SHA-256 signature. Unsigned or mis-signed events are logged and rejected with a 401, and the public endpoint refuses to create any row until the signature is valid, so it cannot be used to flood the event table.
Replays are acknowledged and ignored
Every event is keyed by connection and external event id, with a database uniqueness constraint behind a pre check. A duplicate delivery, even one that races a concurrent copy, is answered with a 200 and never processed twice.
The sender never waits on a sync
A verified event is parked on the in database queue and acknowledged immediately, so a slow downstream sync never times out the delivery. Failures retry with exponential backoff and dead letter with an alert rather than vanishing.
Day in the life
An employee record changes upstream
Employment Hero posts an employee.updated event to the connection's webhook URL. The receiver verifies the HMAC signature in constant time, checks it has not seen this event id before, records it, and queues it, all in well under the sender's timeout. The queue then drains the job: because the subscription names the entity id path and the job has a detail endpoint, the sync fetches just that one employee, maps it, and upserts against the external id cross reference. If the detail endpoint returns 404 and the event type is marked as a delete, the linked Odoo record is archived instead. A second, duplicate delivery of the same event minutes later is answered with duplicate and does nothing. Nobody polled, and nobody touched code.
Edge cases
The cases most modules quietly ignore.
In the shipped code today, each one a place where a cheaper module silently does the wrong thing.
A duplicate delivery is caught two ways: a pre create search on connection and external event id, and a database unique constraint that catches a concurrent race inside a savepoint. Both answer 200 duplicate, so the event is processed exactly once.
An unsigned, mis-signed, or wrong secret delivery fails the constant time HMAC check and is rejected with 401 before any row is written. The attempt is logged, not stored, so a public endpoint cannot be used to flood the event table.
The body is capped at 1 MB. The declared content length is checked first, then the actual bytes for chunked requests, and an over limit payload is refused with 413 before it is ever read into memory or hashed.
When the subscription names the changed record's id path and the job has a detail endpoint, dispatch fetches only that one record. A retry re-fetches the single record and never re-paginates the whole list endpoint.
An active subscription is refused at config time unless its job declares an updated at path, so the stale overwrite guard can tell an older delivery from a newer one. Same entity events can be pinned to an ordered queue channel so they process in sequence.
Event types marked as deletes archive or unlink the linked Odoo record without calling the detail endpoint. A delete whose record was never synced locally, or whose detail endpoint 404s, is a clean skip, not a failure or a dead letter.
A dispatch whose downstream sync keeps failing retries with exponential backoff, then dead letters. The connection receives a chatter message and a To Do activity with the last error, so an administrator can requeue or fix the cause.
A verified event that matches no subscription is marked processed because there is nothing to sync, but a warning is logged so a missing route is visible instead of silently swallowed.
Each event carries the company of its connection as a stored related field, and subscriptions belong to a company, so event review and routing stay scoped per company.
What is inside
Built to do the job, end to end.
- Inbound endpoint and signature verify. A public POST route resolves the connection by a random path token, reads the raw body, and verifies its HMAC SHA-256 signature against the connection secret using a constant time compare. Two signature header names are tried in order. Unexpected errors return a plain 500 rather than leaking a traceback.
- Event records and replay constraint. Every verified delivery is stored as an eh.webhook.event with its type, external id, verification result and raw JSON payload, ordered newest first. A unique constraint on connection and external event id provides replay protection at the database level and gives a full audit trail of what arrived.
- Subscriptions and routing. An eh.webhook.subscription binds an event type to a sync job, scoped to a connection or global, with optional entity id path for targeted fetch and delete event types for upstream deletions. Config constraints block a targeting and ordering mismatch and require a job that tracks a source timestamp.
- Connection webhook identity. The connection model gains a generated path token, an encrypted shared secret, a computed webhook URL to hand to the platform, and an optional webhook entity path for per entity ordering. A one click action generates a fresh token and secret. The secret is encrypted at rest and gated to system administrators.
- Queue handoff and dead letter alerting. Verified events are enqueued on the suite's in database queue, on a per entity ordered channel when configured. A failed dispatch raises so the queue records it, retries with backoff, and on dead letter posts a chatter message and a To Do activity on the connection. Menus and views expose events and subscriptions for review.
Honest about the edges
What this does not do, so nothing surprises you.
- This is an inbound receiver only. It does not push Odoo changes back to the Employment Hero platform, and it does not perform two way synchronisation.
- It does not resolve two sided edit conflicts. Ordering and stale overwrite protection are provided through the required updated at timestamp on the sync job, not field level merge.
- It does not contain the sync engine or the queue itself. It depends on the suite connector, sync engine and queue modules to do the actual synchronisation and delivery work.
- Signature verification assumes the platform signs the raw body with a shared secret using HMAC SHA-256 as a hex digest. A different signing scheme would need adapting.
- The in database queue is sized for light to medium webhook volume. Very high throughput workloads may warrant a dedicated message broker, which this module does not provide.
- Built and tested against the published Employment Hero webhook behaviour. Platform side webhook configuration, event types and payload shapes are owned by the platform and may change.
Employment Hero webhook Odoo, Odoo 18 webhook receiver, HMAC signature verification Odoo, webhook replay protection, Employment Hero integration Odoo, inbound webhook Odoo Community, event driven sync Odoo, idempotent webhook handling, Odoo HR integration, people platform webhook connector, asynchronous queue Odoo, webhook event routing Odoo
Need this fitted to the way you work?
ERP Heritage delivers end to end Odoo work: Odoo Implementation, Customization and Development, Integration, Migration, Consultation, Support and Training. We help teams put this module into production, shape it to their process, and keep it running.
We work with businesses across Australia (Melbourne, Sydney, Brisbane, Perth, Adelaide, Canberra) and the Middle East (Dubai, Abu Dhabi, Riyadh, Jeddah, Doha, Kuwait City, Muscat). Start a conversation at erpheritage.com.au or email info@erpheritage.com.au.
Languages
Available in 19 languages
The interface ships translated out of the box. Switch language in Odoo and the fields, menus, and messages follow.
Modules teams pair with this one.
Premium ERP Heritage modules that extend the same stack, each built to the same engineering bar.
Sync attendance clock events from the Employment Hero people platform into the stock Odoo Attendances app, keyed...
The Singapore country pack for the ERP Heritage Employment Hero integration
The complete ERP Heritage Employment Hero integration in one install
Sync timesheet entries from the Employment Hero people and payroll platform into the standard Odoo Timesheets app...
Real-time fiscalisation of customer invoices and credit notes with the Mauritius Revenue Authority e-Invoicing (E...
| Availability |
Odoo Online
Odoo.sh
On Premise
|
| Odoo Apps Dependencies |
Discuss (mail)
|
| Community Apps Dependencies | Show |
| Lines of code | 4449 |
| Technical Name |
eh_hero_webhook |
| License | OPL-1 |
| Website | https://www.erpheritage.com.au/ |
Odoo Proprietary License v1.0 This software and associated files (the "Software") may only be used (executed, modified, executed after modifications) if you have purchased a valid license from the authors, typically via Odoo Apps, or if you have received a written agreement from the authors of the Software (see the COPYRIGHT file). You may develop Odoo modules that use the Software as a library (typically by depending on it, importing it and using its resources), but without copying any source code or material from the Software. You may distribute those modules under the license of your choice, provided that this license is compatible with the terms of the Odoo Proprietary License (For example: LGPL, MIT, or proprietary licenses similar to this one). It is forbidden to publish, distribute, sublicense, or sell copies of the Software or modified copies of the Software. The above copyright notice and this permission notice must be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Please log in to comment on this module