Webhooks

curl -sS -X POST "https://api.sign.yt/v1/webhooks" \
  -H "Authorization: Bearer $SIGNYT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/hooks/signyt", "events": ["document.completed", "document.rejected", "recipient.signed"]}'

import os
from signyt import Signyt

client = Signyt(os.environ["SIGNYT_API_KEY"])
hook = client.webhooks.create(
    "https://example.com/hooks/signyt",
    ["document.completed", "document.rejected", "recipient.signed"],
)
print(hook.id, hook.secret)  # save the secret now

import { Signyt } from "@signyt/sdk";

const client = new Signyt(process.env.SIGNYT_API_KEY!);
const hook = await client.webhooks.create({
  url: "https://example.com/hooks/signyt",
  events: ["document.completed", "document.rejected", "recipient.signed"],
});
console.log(hook.id, hook.secret); // save the secret now

# pip install flask
import hashlib
import hmac
import json
import os
from datetime import datetime, timezone

from flask import Flask, abort, request

SECRET = os.environ["SIGNYT_WEBHOOK_SECRET"]
app = Flask(__name__)


def verify(raw: bytes, timestamp: str, signature: str) -> bool:
    expected = hmac.new(SECRET.encode(), timestamp.encode() + b"." + raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, signature.removeprefix("sha256=")):
        return False
    try:
        sent = datetime.fromisoformat(timestamp.replace("Z", "+00:00"))
    except ValueError:
        return False
    return abs((datetime.now(timezone.utc) - sent).total_seconds()) <= 300


@app.post("/hooks/signyt")
def signyt_webhook():
    raw = request.get_data()
    if not verify(raw, request.headers.get("X-Signyt-Timestamp", ""),
                  request.headers.get("X-Signyt-Signature", "")):
        abort(400)
    event = json.loads(raw)
    print(event["event_id"], event["event"], event["data"].get("id"))
    return "", 204

// npm install express
import { createHmac, timingSafeEqual } from "node:crypto";
import express from "express";

const SECRET = process.env.SIGNYT_WEBHOOK_SECRET!;
const app = express();

function verify(raw: Buffer, timestamp: string, signature: string): boolean {
  const expected = createHmac("sha256", SECRET).update(`${timestamp}.`).update(raw).digest("hex");
  const got = signature.replace(/^sha256=/, "");
  if (got.length !== expected.length || !timingSafeEqual(Buffer.from(got), Buffer.from(expected))) {
    return false;
  }
  const sent = Date.parse(timestamp);
  return Number.isFinite(sent) && Math.abs(Date.now() - sent) <= 5 * 60 * 1000;
}

// express.raw keeps the exact bytes that were signed.
app.post("/hooks/signyt", express.raw({ type: "application/json" }), (req, res) => {
  if (!verify(req.body, req.get("X-Signyt-Timestamp") ?? "", req.get("X-Signyt-Signature") ?? "")) {
    return res.sendStatus(400);
  }
  const event = JSON.parse(req.body.toString("utf8"));
  console.log(event.event_id, event.event, event.data.id);
  res.sendStatus(204);
});

app.listen(3000);

<?php
$secret = getenv('SIGNYT_WEBHOOK_SECRET');
$raw = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_SIGNYT_TIMESTAMP'] ?? '';
$signature = preg_replace('/^sha256=/', '', $_SERVER['HTTP_X_SIGNYT_SIGNATURE'] ?? '');

$expected = hash_hmac('sha256', $timestamp . '.' . $raw, $secret);
$sent = strtotime($timestamp);

if (!hash_equals($expected, $signature) || $sent === false || abs(time() - $sent) > 300) {
    http_response_code(400);
    exit;
}

$event = json_decode($raw, true);
error_log($event['event_id'] . ' ' . $event['event']);
http_response_code(204);

from signyt import SignatureVerificationError
from signyt.webhooks import construct_event

try:
    # headers: any mapping (case-insensitive lookup), raw: the request body bytes
    event = construct_event(raw, request.headers, os.environ["SIGNYT_WEBHOOK_SECRET"])
except SignatureVerificationError:
    abort(400)

import { constructWebhookEvent, SignatureVerificationError } from "@signyt/sdk";

try {
  // raw: string or Uint8Array of the exact body; headers: Headers or a plain object
  const event = await constructWebhookEvent(raw, headers, process.env.SIGNYT_WEBHOOK_SECRET!);
  console.log(event.event, event.data);
} catch (e) {
  if (e instanceof SignatureVerificationError) { /* respond 400 */ } else throw e;
}

curl -sS "https://api.sign.yt/v1/webhooks/$WEBHOOK_ID/deliveries?limit=20" \
  -H "Authorization: Bearer $SIGNYT_API_KEY" | jq '.[] | {id, event_type, status, attempt, response_status_code}'

curl -sS -X POST "https://api.sign.yt/v1/webhooks/deliveries/$DELIVERY_ID/redeliver" \
  -H "Authorization: Bearer $SIGNYT_API_KEY"

import os
import httpx

http = httpx.Client(
    base_url="https://api.sign.yt/v1",
    headers={"Authorization": f"Bearer {os.environ['SIGNYT_API_KEY']}"},
)
deliveries = http.get(f"/webhooks/{os.environ['WEBHOOK_ID']}/deliveries", params={"limit": 20}).json()
for d in deliveries:
    if d["status"] == "DEAD":
        http.post(f"/webhooks/deliveries/{d['id']}/redeliver").raise_for_status()

const base = "https://api.sign.yt/v1";
const headers = { Authorization: `Bearer ${process.env.SIGNYT_API_KEY}` };

const res = await fetch(`${base}/webhooks/${process.env.WEBHOOK_ID}/deliveries?limit=20`, { headers });
for (const d of (await res.json()) as { id: string; status: string }[]) {
  if (d.status === "DEAD") {
    await fetch(`${base}/webhooks/deliveries/${d.id}/redeliver`, { method: "POST", headers });
  }
}