Agent skill · software engineering · jeremylongshore
ramp-webhooks-events
Build a verified, idempotent Ramp webhook receiver with raw-body HMAC validation, fast acknowledgement, durable processing, and reconciliation. Use when handling transaction, bill, reimbursement, spend-request, or other Ramp events. Trigger with "Ramp webhooks" or "verify Ramp signature".
Why this skill is useful
Provides specific API call patterns and error handling for Ramp's corporate card management that the AI wouldn't reliably generate on its own.
What it needs
Requires ramp account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Ramp Webhook Verification and Processing Overview Verify authenticity before parsing, acknowledge only after durable receipt, and treat each event as a notification to reconcile current resource state. Design for retries, duplicates, and out-of-order delivery. Prerequisites Identify the Ramp application, environment, business entities, affected data and workflows, accountable owner, and rollback boundary. Read references/official-docs.md and re-check endpoint schemas, scopes, limits, and support status before a live operation. Use synthetic fixtures or Ramp sandbox until production access and business effects are explicitly approved. Prepare approved secret storage and a sanitized evidence location. Current Contract New subscriptions begin pendingverification; Ramp sends a challenge that must be returned and submitted to activate the subscription. Business deliveries include X-Ramp-Webhook-ID and X-Ramp-Signature; the latter is HMAC-SHA256 of the exact raw request body using the subscription secret. Receivers must respond within 10 seconds. Ramp retries 429, 5xx, timeouts, and connection errors up to 10 total attempts with exponential backoff and jitter. The same event ID is reused across retries, and events may arrive out of order. Instructions 1. Select only documented event types and underlying read scopes; register an HTTPS endpoint and store the returned webhook secret in an approved secret manager. 2. Complete the challenge flow and record subscription ID, state, business, events, scopes, endpoint, secret version, and owner without logging the secret. 3. Capture exact raw bytes, verify X-Ramp-Signature with constant-time comparison, validate expected event/business, then deduplicate by stable event ID. 4. Durably enqueue the verified event before returning 2xx within 10 seconds; process asynchronously and fetch current resource state when business action needs full or ordered data. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/ramp-webhooks-events