Webhooks

{
  "event_type": "audit.completed",
  "audit_id": "9b1c8a3e-4d2f-4f8b-9c1a-7d3e5f8b2a4c",
  "connection_id": "1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d",
  "score": 78,
  "total_findings": 42,
  "by_severity": { "critical": 1, "high": 4, "medium": 17, "low": 20 },
  "total_monthly_waste": 312.50,
  "occurred_at": "2026-05-01T14:23:45Z"
}

import hmac, hashlib, time
from fastapi import Request, HTTPException

WEBHOOK_SECRET = "your-32-char-secret-from-cloudarq"
TOLERANCE_SECONDS = 300  # 5 minutes

async def verify(request: Request) -> dict:
    sig_header = request.headers["X-CloudArq-Signature"]
    body = await request.body()

    # Parse "t=<ts>,v1=<hex>"
    parts = dict(p.split("=", 1) for p in sig_header.split(","))
    ts = int(parts["t"])
    sig = parts["v1"]

    # Reject stale or future-dated requests (replay protection).
    if abs(time.time() - ts) > TOLERANCE_SECONDS:
        raise HTTPException(401, "stale signature")

    expected = hmac.new(
        WEBHOOK_SECRET.encode(),
        f"{ts}.".encode() + body,
        hashlib.sha256,
    ).hexdigest()
    if not hmac.compare_digest(expected, sig):
        raise HTTPException(401, "bad signature")

    return await request.json()

import crypto from "node:crypto";
import express from "express";

const WEBHOOK_SECRET = "your-32-char-secret-from-cloudarq";
const TOLERANCE_SECONDS = 300; // 5 minutes

// IMPORTANT: use express.raw() so req.body is the exact bytes the
// HMAC was computed over. express.json() re-serialises and breaks
// signature verification.
app.post(
  "/webhooks/cloudarq",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const sigHeader = req.header("X-CloudArq-Signature") ?? "";
    const parts = Object.fromEntries(
      sigHeader.split(",").map((p) => p.split("=", 2)),
    );
    const ts = parseInt(parts.t, 10);
    const sig = parts.v1;

    if (Math.abs(Date.now() / 1000 - ts) > TOLERANCE_SECONDS) {
      return res.status(401).send("stale signature");
    }

    const expected = crypto
      .createHmac("sha256", WEBHOOK_SECRET)
      .update(`${ts}.`)
      .update(req.body)
      .digest("hex");

    const a = Buffer.from(expected, "hex");
    const b = Buffer.from(sig, "hex");
    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return res.status(401).send("bad signature");
    }

    const event = JSON.parse(req.body.toString("utf8"));
    // ...handle event...
    res.status(204).end();
  },
);