Security on POST /api/bc-webhook

[andlrutt]

Description

Currently SpringVerify hits a webhook api when the background check is finished. This works, but anyone can currently call this endpoint without authorization. Theoretically someone could approve their own background check. Can we lock this down?

Technical Details

• Investigate options and report to team for approval. Potential solutions:
  • Some unique identifier only SpringVerify has
  • Whitelisting static IPs
• Implement solution
• end to end test (work with Zavier)
  • Attempt to hit api manually without authorization

Dependencies