Webhooks API

{
  "subscriptions": [
    {
      "id": "clxyz1234",
      "tenantId": "ten_abc",
      "eventType": "user.created",
      "webhookUrl": "https://api.yourapp.com/webhooks/auris",
      "maxRetries": 3,
      "retryDelayMs": 5000,
      "enabled": true,
      "signingSecret": null,
      "createdAt": "2025-01-15T10:00:00Z",
      "updatedAt": "2025-01-15T10:00:00Z"
    }
  ],
  "pagination": {
    "total": 5,
    "limit": 50,
    "skip": 0,
    "remaining": 0
  }
}

{
  "eventType": "user.created",
  "webhookUrl": "https://api.yourapp.com/webhooks/auris",
  "maxRetries": 3,
  "retryDelayMs": 5000
}

{
  "id": "clxyz5678",
  "tenantId": "ten_abc",
  "eventType": "user.created",
  "webhookUrl": "https://api.yourapp.com/webhooks/auris",
  "maxRetries": 3,
  "retryDelayMs": 5000,
  "enabled": true,
  "signingSecret": "whsec_7f3a8b2c4d5e6f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4",
  "createdAt": "2025-02-18T10:00:00Z",
  "updatedAt": "2025-02-18T10:00:00Z"
}

{
  "enabled": false,
  "maxRetries": 5,
  "retryDelayMs": 10000
}

{
  "id": "clxyz5678",
  "tenantId": "ten_abc",
  "eventType": "user.created",
  "webhookUrl": "https://api.yourapp.com/webhooks/auris",
  "maxRetries": 5,
  "retryDelayMs": 10000,
  "enabled": false,
  "signingSecret": "whsec_...",
  "createdAt": "2025-02-18T10:00:00Z",
  "updatedAt": "2025-02-18T11:00:00Z"
}

{
  "success": true
}

{
  "signingSecret": "whsec_9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a"
}

{
  "eventType": "user.created",
  "timestamp": "2025-02-18T10:00:00Z",
  "tenantId": "b3f1c2d4-5e6a-7b8c-9d0e-1f2a3b4c5d6e",
  "data": {
    "userId": "usr_abc123",
    "email": "[email protected]",
    "firstName": "Alice",
    "lastName": "Smith"
  }
}

import crypto from 'crypto';
 
function verifyWebhookSignature(rawBody, signature, timestamp, secret) {
  // 1. Check timestamp freshness (optional but recommended)
  const currentTime = Math.floor(Date.now() / 1000);
  if (Math.abs(currentTime - parseInt(timestamp)) > 300) {
    throw new Error('Webhook timestamp is too old');
  }
 
  // 2. Compute expected signature
  const signedPayload = `${timestamp}.${rawBody}`;
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');
 
  // 3. Timing-safe comparison — the header is `sha256=<hex>`, strip the prefix
  const receivedHex = signature.startsWith('sha256=') ? signature.slice(7) : signature;
  const expected = Buffer.from(expectedSignature, 'hex');
  const received = Buffer.from(receivedHex, 'hex');
 
  if (expected.length !== received.length) {
    return false;
  }
 
  return crypto.timingSafeEqual(expected, received);
}
 
// Express.js handler
app.post('/webhooks/auris', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-auris-signature'];
  const timestamp = req.headers['x-auris-timestamp'];
  const rawBody = req.body.toString('utf-8');
 
  if (!verifyWebhookSignature(rawBody, signature, timestamp, process.env.AURIS_WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
 
  const event = JSON.parse(rawBody);
  console.log(`Received ${event.eventType}:`, event.data);
 
  // Process the event...
 
  res.status(200).json({ received: true });
});

import hmac
import hashlib
import time
 
def verify_webhook_signature(raw_body: bytes, signature: str, timestamp: str, secret: str) -> bool:
    # Check timestamp freshness
    current_time = int(time.time())
    if abs(current_time - int(timestamp)) > 300:
        return False
 
    # Compute expected signature
    signed_payload = f"{timestamp}.{raw_body.decode('utf-8')}"
    expected = hmac.new(
        secret.encode('utf-8'),
        signed_payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
 
    # Timing-safe comparison — the header is "sha256=<hex>", strip the prefix
    received = signature[7:] if signature.startswith("sha256=") else signature
    return hmac.compare_digest(expected, received)