Webhooks

curl -X POST "https://api.promptreports.ai/v1/webhooks" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://yourapp.com/webhooks/promptreports",
    "events": [
      "prompt.created",
      "prompt.updated",
      "report.completed",
      "evaluation.completed"
    ],
    "description": "Production webhook endpoint"
  }'

{
  "id": "wh_abc123",
  "url": "https://yourapp.com/webhooks/promptreports",
  "events": [
    "prompt.created",
    "prompt.updated",
    "report.completed",
    "evaluation.completed"
  ],
  "secret": "whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "status": "active",
  "createdAt": "2024-01-15T10:30:00Z"
}

{
  "id": "evt_xyz789",
  "type": "prompt.updated",
  "apiVersion": "2024-01-15",
  "createdAt": "2024-01-15T14:32:10Z",
  "data": {
    "object": "prompt",
    "id": "prm_abc123",
    "name": "Customer Support Response",
    "content": "You are a helpful customer support agent...",
    "folderId": "fld_def456",
    "version": 3,
    "updatedAt": "2024-01-15T14:32:10Z",
    "updatedBy": "user_ghi789"
  },
  "metadata": {
    "organizationId": "org_jkl012",
    "workspaceId": "ws_mno345",
    "triggeredBy": "api"
  }
}

X-PromptReports-Signature: t=1673456789,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd
X-PromptReports-Timestamp: 1673456789

import crypto from 'crypto';

function verifyWebhookSignature(
  payload: string,
  signature: string,
  secret: string
): boolean {
  // Parse the signature header
  const parts = signature.split(',');
  const timestamp = parts.find(p => p.startsWith('t='))?.split('=')[1];
  const expectedSig = parts.find(p => p.startsWith('v1='))?.split('=')[1];

  if (!timestamp || !expectedSig) {
    return false;
  }

  // Verify timestamp is within tolerance (5 minutes)
  const currentTime = Math.floor(Date.now() / 1000);
  if (Math.abs(currentTime - parseInt(timestamp)) > 300) {
    console.error('Webhook timestamp outside tolerance window');
    return false;
  }

  // Compute expected signature
  const signedPayload = `${timestamp}.${payload}`;
  const computedSig = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  // Constant-time comparison to prevent timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(expectedSig),
    Buffer.from(computedSig)
  );
}

// Express.js middleware example
app.post('/webhooks/promptreports', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-promptreports-signature'] as string;
  const payload = req.body.toString();

  if (!verifyWebhookSignature(payload, signature, process.env.WEBHOOK_SECRET!)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = JSON.parse(payload);
  // Process the event...

  res.status(200).json({ received: true });
});

import hmac
import hashlib
import time

def verify_webhook_signature(payload: bytes, signature: str, secret: str) -> bool:
    # Parse signature header
    parts = dict(p.split('=') for p in signature.split(','))
    timestamp = parts.get('t')
    expected_sig = parts.get('v1')

    if not timestamp or not expected_sig:
        return False

    # Verify timestamp (5 minute tolerance)
    if abs(time.time() - int(timestamp)) > 300:
        return False

    # Compute signature
    signed_payload = f"{timestamp}.{payload.decode('utf-8')}"
    computed_sig = hmac.new(
        secret.encode('utf-8'),
        signed_payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()

    # Constant-time comparison
    return hmac.compare_digest(expected_sig, computed_sig)

const processedEvents = new Set<string>(); // Use Redis/database in production

app.post('/webhooks/promptreports', async (req, res) => {
  const event = req.body;

  // Check for duplicate delivery
  if (processedEvents.has(event.id)) {
    console.log(`Skipping duplicate event: ${event.id}`);
    return res.status(200).json({ received: true, duplicate: true });
  }

  // Process the event
  try {
    await processEvent(event);
    processedEvents.add(event.id);
    res.status(200).json({ received: true });
  } catch (error) {
    // Return 500 to trigger retry
    res.status(500).json({ error: 'Processing failed' });
  }
});

import { Queue } from 'bullmq';

const webhookQueue = new Queue('webhook-processing');

app.post('/webhooks/promptreports', async (req, res) => {
  // Verify signature first
  if (!verifySignature(req)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = req.body;

  // Immediately acknowledge receipt
  res.status(200).json({ received: true });

  // Queue for async processing
  await webhookQueue.add('process-event', {
    eventId: event.id,
    eventType: event.type,
    payload: event,
  }, {
    attempts: 3,
    backoff: { type: 'exponential', delay: 1000 },
  });
});

// Process events asynchronously
webhookQueue.process('process-event', async (job) => {
  const { eventType, payload } = job.data;

  switch (eventType) {
    case 'prompt.updated':
      await handlePromptUpdate(payload.data);
      break;
    case 'report.completed':
      await handleReportComplete(payload.data);
      break;
    // Handle other event types...
  }
});

curl -X POST "https://api.promptreports.ai/v1/webhooks/wh_abc123/test" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "eventType": "prompt.updated"
  }'

curl -X GET "https://api.promptreports.ai/v1/webhooks/wh_abc123/deliveries" \
  -H "Authorization: Bearer YOUR_API_KEY"

# Response includes delivery status, response codes, and timing
{
  "deliveries": [
    {
      "id": "del_xyz789",
      "eventId": "evt_abc123",
      "eventType": "prompt.updated",
      "status": "success",
      "httpStatus": 200,
      "responseTime": 245,
      "attemptNumber": 1,
      "deliveredAt": "2024-01-15T14:32:15Z"
    }
  ]
}

# Start your local server
npm run dev  # Running on http://localhost:3000

# In another terminal, create a tunnel
ngrok http 3000

# Use the ngrok URL for your webhook endpoint
# Example: https://abc123.ngrok.io/webhooks/promptreports