Task Webhooks

{
  "id": "evt_01abcdef",
  "type": "generation.completed",
  "api_version": "v1",
  "created_at": 1783953302,
  "data": {
    "task_id": "tsk_01abcdef",
    "client_business_id": "order_123",
    "task_type": "image",
    "model": "model-name",
    "status": "SUCCESS",
    "progress": "100%",
    "result": {
      "type": "image",
      "data": [{"url": "https://cdn.example/result.png"}]
    },
    "error": null,
    "submitted_at": 1783953000,
    "finished_at": 1783953300
  }
}

{
  "id": "evt_01failure",
  "type": "generation.failed",
  "api_version": "v1",
  "created_at": 1783953302,
  "data": {
    "task_id": "tsk_01failure",
    "client_business_id": "order_456",
    "task_type": "video",
    "model": "model-name",
    "status": "FAILURE",
    "progress": "100%",
    "result": null,
    "error": {
      "code": "generation_failed",
      "message": "Generation failed after retries"
    },
    "submitted_at": 1783953000,
    "finished_at": 1783953300
  }
}

{
  "id": "evt_01test",
  "type": "endpoint.test",
  "api_version": "v1",
  "created_at": 1783953302,
  "data": {
    "task_id": "endpoint_test",
    "task_type": "image",
    "status": "SUCCESS",
    "progress": "100%",
    "result": {"message": "ToAPIs webhook endpoint test"},
    "error": null,
    "submitted_at": 0,
    "finished_at": 0
  }
}

User-Agent: ToAPIs-Webhook/1.0
X-ToAPIs-Webhook-Id: evt_01abcdef
X-ToAPIs-Webhook-Timestamp: 1783953302
X-ToAPIs-Webhook-Signature: v1=<hex-signature>[,v1=<previous-hex-signature>]

event_id + "." + timestamp + "." + raw_request_body

import hashlib, hmac, time

def verify(headers, raw_body, secrets):
    event_id = headers["X-ToAPIs-Webhook-Id"]
    timestamp = int(headers["X-ToAPIs-Webhook-Timestamp"])
    if abs(time.time() - timestamp) > 300:
        return False
    signed = f"{event_id}.{timestamp}.".encode() + raw_body
    received = [v.removeprefix("v1=") for v in headers["X-ToAPIs-Webhook-Signature"].split(",")]
    return any(hmac.compare_digest(hmac.new(s.encode(), signed, hashlib.sha256).hexdigest(), r)
               for s in secrets for r in received)

import crypto from 'node:crypto';

export function verify(headers, rawBody, secrets) {
  const id = headers['x-toapis-webhook-id'];
  const ts = Number(headers['x-toapis-webhook-timestamp']);
  if (Math.abs(Date.now() / 1000 - ts) > 300) return false;
  const signed = Buffer.concat([Buffer.from(`${id}.${ts}.`), rawBody]);
  const received = headers['x-toapis-webhook-signature'].split(',').map(v => v.replace(/^v1=/, ''));
  return secrets.some(secret => received.some(sig => {
    const expected = crypto.createHmac('sha256', secret).update(signed).digest('hex');
    return expected.length === sig.length && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig));
  }));
}

func Verify(id, timestamp, signature string, body []byte, secrets []string) bool {
    ts, err := strconv.ParseInt(timestamp, 10, 64)
    now := time.Now().Unix()
    if err != nil || now-ts > 300 || ts-now > 300 { return false }
    signed := append([]byte(id+"."+timestamp+"."), body...)
    for _, secret := range secrets {
        mac := hmac.New(sha256.New, []byte(secret)); mac.Write(signed)
        expected := hex.EncodeToString(mac.Sum(nil))
        for _, value := range strings.Split(signature, ",") {
            if hmac.Equal([]byte(expected), []byte(strings.TrimPrefix(value, "v1="))) { return true }
        }
    }
    return false
}