Webhooks

curl -X POST https://api.limitguard.ai/v1/webhooks \
  -H "X-API-Key: lg_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.com/webhooks/limitguard",
    "events": ["entity.checked", "score.updated", "compliance.alert"]
  }'

import httpx

response = httpx.post(
    "https://api.limitguard.ai/v1/webhooks",
    headers={"X-API-Key": "lg_live_xxxxxxxxxxxxxxxxxxxx"},
    json={
        "url": "https://your-app.com/webhooks/limitguard",
        "events": ["entity.checked", "score.updated", "compliance.alert"],
    },
)
webhook = response.json()
print(webhook["webhook_id"])   # wh_abc123
print(webhook["secret"])       # whsec_xxxxxxxxxxxxxxxx — store this securely

const response = await fetch("https://api.limitguard.ai/v1/webhooks", {
  method: "POST",
  headers: {
    "X-API-Key": "lg_live_xxxxxxxxxxxxxxxxxxxx",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    url: "https://your-app.com/webhooks/limitguard",
    events: ["entity.checked", "score.updated", "compliance.alert"],
  }),
});
const webhook = await response.json();
console.log(webhook.webhook_id); // wh_abc123
console.log(webhook.secret);     // whsec_xxxxxxxxxxxxxxxx — store this securely

import hashlib
import hmac

def verify_signature(payload: bytes, signature_header: str, secret: str) -> bool:
    """
    Returns True if the payload matches the LimitGuard signature.
    Always use this before processing any webhook event.
    """
    expected = hmac.new(
        secret.encode("utf-8"),
        payload,
        hashlib.sha256,
    ).hexdigest()

    # Use hmac.compare_digest to prevent timing attacks
    return hmac.compare_digest(f"sha256={expected}", signature_header)


# --- FastAPI example ---
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()
WEBHOOK_SECRET = "whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"  # from env

@app.post("/webhooks/limitguard")
async def handle_webhook(request: Request):
    payload = await request.body()
    signature = request.headers.get("X-LimitGuard-Signature", "")

    if not verify_signature(payload, signature, WEBHOOK_SECRET):
        raise HTTPException(status_code=401, detail="Invalid signature")

    event = await request.json()
    # Hand off to async worker — respond 200 immediately
    await process_event(event)
    return {"received": True}

import crypto from "crypto";
import express from "express";

const WEBHOOK_SECRET = process.env.LIMITGUARD_WEBHOOK_SECRET;

function verifySignature(payload, signatureHeader, secret) {
  const expected = `sha256=${crypto
    .createHmac("sha256", secret)
    .update(payload)
    .digest("hex")}`;

  // Use timingSafeEqual to prevent timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatureHeader)
  );
}

const app = express();

app.post(
  "/webhooks/limitguard",
  // Use raw body — JSON parsing breaks the HMAC
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = req.headers["x-limitguard-signature"] ?? "";

    if (!verifySignature(req.body, signature, WEBHOOK_SECRET)) {
      return res.status(401).json({ error: "Invalid signature" });
    }

    const event = JSON.parse(req.body);
    // Acknowledge immediately, process asynchronously
    res.json({ received: true });
    processEvent(event).catch(console.error);
  }
);

async def process_event(event: dict):
    event_type = event["type"]
    data = event["data"]

    if event_type == "entity.checked":
        await on_entity_checked(data)
    elif event_type == "score.updated":
        await on_score_updated(data)
    elif event_type == "compliance.alert":
        await on_compliance_alert(data)
    elif event_type == "certificate.issued":
        await on_certificate_issued(data)
    elif event_type == "certificate.revoked":
        await on_certificate_revoked(data)
    else:
        # Forward-compatible: ignore unknown event types
        pass

async function processEvent(event) {
  const { type, data } = event;

  switch (type) {
    case "entity.checked":
      await onEntityChecked(data);
      break;
    case "score.updated":
      await onScoreUpdated(data);
      break;
    case "compliance.alert":
      await onComplianceAlert(data);
      break;
    case "certificate.issued":
      await onCertificateIssued(data);
      break;
    case "certificate.revoked":
      await onCertificateRevoked(data);
      break;
    default:
      // Forward-compatible: ignore unknown event types
      break;
  }
}