HailMate calls you

curl -X POST https://app.hailmate.ai/api/v1/webhooks \
  -H "Authorization: Bearer $HAILMATE_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
  "event": "job.stage_changed",
  "target_url": "https://yourapp.example.com/hooks/hailmate",
  "filters": {
    "stage": "claim_approved"
  }
}'

import { randomUUID } from 'node:crypto';

const response = await fetch('https://app.hailmate.ai/api/v1/webhooks', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.HAILMATE_API_KEY}`,
    'Content-Type': 'application/json',
    'Idempotency-Key': randomUUID(),
  },
  body: JSON.stringify({
    event: 'job.stage_changed',
    target_url: 'https://yourapp.example.com/hooks/hailmate',
    filters: {
      stage: 'claim_approved',
    },
  }),
});

const data = await response.json();
if (!response.ok) throw new Error(`${data.error.code}: ${data.error.message}`);

import os
import uuid

import requests

response = requests.post(
    "https://app.hailmate.ai/api/v1/webhooks",
    headers={
        "Authorization": f"Bearer {os.environ['HAILMATE_API_KEY']}",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={
        "event": "job.stage_changed",
        "target_url": "https://yourapp.example.com/hooks/hailmate",
        "filters": {
            "stage": "claim_approved",
        },
    },
)
response.raise_for_status()
data = response.json()

import crypto from 'node:crypto';
import express from 'express';

function verifyHailMateSignature(rawBody, header, secret, toleranceSeconds = 300) {
  const pairs = String(header || '')
    .split(',')
    .map((piece) => piece.trim().split('='));
  const timestamp = pairs.find(([key]) => key === 't')?.[1];
  const signatures = pairs.filter(([key]) => key === 'v1').map(([, value]) => value);
  if (!timestamp || !signatures.length) return false;

  // Refuse anything signed more than five minutes ago: a replayed delivery.
  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!Number.isFinite(age) || age > toleranceSeconds) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.`)
    .update(rawBody) // the RAW bytes, exactly as they arrived
    .digest('hex');

  // While you rotate a secret, two v1 values arrive. Accept either.
  return signatures.some(
    (signature) =>
      signature.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected)),
  );
}

const app = express();

// express.raw keeps the body as bytes. express.json() would parse it first,
// and a re-serialised body no longer matches the signature.
app.post('/hooks/hailmate', express.raw({ type: 'application/json' }), (req, res) => {
  const ok = verifyHailMateSignature(
    req.body,
    req.get('X-HailMate-Signature'),
    process.env.HAILMATE_WEBHOOK_SECRET,
  );
  if (!ok) return res.status(400).send('Invalid signature');

  const event = JSON.parse(req.body.toString('utf8'));
  // Dedupe on event.event_id, then hand the work to a queue and answer fast.
  console.log(event.event_type, event.id);
  res.sendStatus(200);
});

app.listen(3000);

import hashlib
import hmac
import os
import time

from flask import Flask, abort, request


def verify_hailmate_signature(raw_body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    pairs = [piece.strip().split("=", 1) for piece in (header or "").split(",")]
    pairs = [pair for pair in pairs if len(pair) == 2]
    timestamp = next((value for key, value in pairs if key == "t"), None)
    signatures = [value for key, value in pairs if key == "v1"]
    if not timestamp or not signatures:
        return False

    # Refuse anything signed more than five minutes ago: a replayed delivery.
    try:
        if abs(time.time() - int(timestamp)) > tolerance:
            return False
    except ValueError:
        return False

    signed = timestamp.encode() + b"." + raw_body  # the RAW bytes, exactly as they arrived
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    # While you rotate a secret, two v1 values arrive. Accept either.
    return any(hmac.compare_digest(expected, signature) for signature in signatures)


app = Flask(__name__)


@app.post("/hooks/hailmate")
def hailmate_webhook():
    raw_body = request.get_data()  # before anything parses it
    header = request.headers.get("X-HailMate-Signature", "")
    if not verify_hailmate_signature(raw_body, header, os.environ["HAILMATE_WEBHOOK_SECRET"]):
        abort(400)

    event = request.get_json()
    # Dedupe on event["event_id"], then hand the work to a queue and answer fast.
    print(event["event_type"], event["id"])
    return "", 200

<?php

function verify_hailmate_signature(string $rawBody, string $header, string $secret, int $tolerance = 300): bool
{
    $timestamp = null;
    $signatures = [];
    foreach (explode(',', $header) as $piece) {
        $pair = explode('=', trim($piece), 2);
        if (count($pair) !== 2) {
            continue;
        }
        if ($pair[0] === 't') {
            $timestamp = $pair[1];
        } elseif ($pair[0] === 'v1') {
            $signatures[] = $pair[1];
        }
    }
    if ($timestamp === null || !ctype_digit($timestamp) || count($signatures) === 0) {
        return false;
    }

    // Refuse anything signed more than five minutes ago: a replayed delivery.
    if (abs(time() - (int) $timestamp) > $tolerance) {
        return false;
    }

    // The RAW body, exactly as it arrived.
    $expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);

    // While you rotate a secret, two v1 values arrive. Accept either.
    foreach ($signatures as $signature) {
        if (hash_equals($expected, $signature)) {
            return true;
        }
    }
    return false;
}

$rawBody = file_get_contents('php://input');
$header = $_SERVER['HTTP_X_HAILMATE_SIGNATURE'] ?? '';

if (!verify_hailmate_signature($rawBody, $header, (string) getenv('HAILMATE_WEBHOOK_SECRET'))) {
    http_response_code(400);
    exit('Invalid signature');
}

$event = json_decode($rawBody, true);
// Dedupe on $event['event_id'], then hand the work to a queue and answer fast.
http_response_code(200);

curl https://app.hailmate.ai/api/v1/webhooks/samples/job.created \
  -H "Authorization: Bearer $HAILMATE_API_KEY"

const response = await fetch('https://app.hailmate.ai/api/v1/webhooks/samples/job.created', {
  headers: {
    Authorization: `Bearer ${process.env.HAILMATE_API_KEY}`,
  },
});

const data = await response.json();
if (!response.ok) throw new Error(`${data.error.code}: ${data.error.message}`);

import os

import requests

response = requests.get(
    "https://app.hailmate.ai/api/v1/webhooks/samples/job.created",
    headers={
        "Authorization": f"Bearer {os.environ['HAILMATE_API_KEY']}",
    },
)
response.raise_for_status()
data = response.json()