Webhooks

curl -X POST https://api.limitguard.ai/v1/webhooks \
  -H "X-API-Key: lg_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.com/webhooks/limitguard",
    "events": ["sanctions.match.new"]
  }'

import httpx

response = httpx.post(
    "https://api.limitguard.ai/v1/webhooks",
    headers={"X-API-Key": "lg_live_xxxxxxxxxxxxxxxxxxxx"},
    json={
        "url": "https://your-app.com/webhooks/limitguard",
        "events": ["sanctions.match.new"],
    },
)
webhook = response.json()
print(webhook["id"])      # 3f6c2a9e-...
print(webhook["secret"])  # 64 hex characters: store it securely now

const response = await fetch("https://api.limitguard.ai/v1/webhooks", {
  method: "POST",
  headers: {
    "X-API-Key": "lg_live_xxxxxxxxxxxxxxxxxxxx",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    url: "https://your-app.com/webhooks/limitguard",
    events: ["sanctions.match.new"],
  }),
});
const webhook = await response.json();
console.log(webhook.id);     // 3f6c2a9e-...
console.log(webhook.secret); // 64 hex characters: store it securely now

import hashlib
import hmac

def verify_signature(payload: bytes, signature_header: str, secret: str) -> bool:
    expected = hmac.new(secret.encode("utf-8"), payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature_header)


# FastAPI example
import os
from fastapi import FastAPI, HTTPException, Request

app = FastAPI()
WEBHOOK_SECRET = os.environ["LIMITGUARD_WEBHOOK_SECRET"]

@app.post("/webhooks/limitguard")
async def handle_webhook(request: Request):
    payload = await request.body()
    signature = request.headers.get("X-Limitguard-Signature", "")
    if not verify_signature(payload, signature, WEBHOOK_SECRET):
        raise HTTPException(status_code=401, detail="Invalid signature")

    event = await request.json()
    await queue_for_processing(event)  # respond fast, work in the background
    return {"received": True}

import crypto from "crypto";
import express from "express";

const WEBHOOK_SECRET = process.env.LIMITGUARD_WEBHOOK_SECRET;

function verifySignature(payload, signatureHeader, secret) {
  const expected = crypto.createHmac("sha256", secret).update(payload).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signatureHeader || "");
  // timingSafeEqual throws on a length mismatch, so check that first
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

const app = express();

app.post(
  "/webhooks/limitguard",
  // Keep the raw body: re-serialised JSON will not match the signature
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = req.headers["x-limitguard-signature"];
    if (!verifySignature(req.body, signature, WEBHOOK_SECRET)) {
      return res.status(401).json({ error: "Invalid signature" });
    }
    const event = JSON.parse(req.body);
    res.json({ received: true }); // acknowledge first
    processEvent(event).catch(console.error);
  }
);

async def process_event(event: dict):
    if event["event"] != "sanctions.match.new":
        return  # test deliveries and future event types: acknowledge and ignore

    alert = event["data"]
    if alert["event_type"] == "designated":
        await freeze_and_escalate(alert)
    elif alert["event_type"] == "amended":
        await rescreen(alert)
    elif alert["event_type"] == "delisted":
        await review_restrictions(alert)

async function processEvent(event) {
  if (event.event !== "sanctions.match.new") return; // test and future types

  const alert = event.data;
  switch (alert.event_type) {
    case "designated":
      await freezeAndEscalate(alert);
      break;
    case "amended":
      await rescreen(alert);
      break;
    case "delisted":
      await reviewRestrictions(alert);
      break;
  }
}