Webhooks

curl -X POST 'https://trackerv2.marketingplanet.global/api/v1/webhooks' \
  -H 'Authorization: Bearer tk_live_YOUR_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
  "url": "https://hooks.acmeretail.com/tracker",
  "description": "Ops channel",
  "events": [
    "uptime.down",
    "uptime.recovered"
  ],
  "projectIds": [
    "6650a4c2e1b3d5f7a9c1e301"
  ]
}'

const response = await fetch('https://trackerv2.marketingplanet.global/api/v1/webhooks', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer tk_live_YOUR_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "url": "https://hooks.acmeretail.com/tracker",
    "description": "Ops channel",
    "events": [
      "uptime.down",
      "uptime.recovered"
    ],
    "projectIds": [
      "6650a4c2e1b3d5f7a9c1e301"
    ]
  }),
});

const result = await response.json();
if (!response.ok) throw new Error(`${result.error.code}: ${result.error.message}`);
console.log(result.data);

import requests

response = requests.post(
    "https://trackerv2.marketingplanet.global/api/v1/webhooks",
    headers={"Authorization": "Bearer tk_live_YOUR_KEY"},
    json={
        "url": "https://hooks.acmeretail.com/tracker",
        "description": "Ops channel",
        "events": [
            "uptime.down",
            "uptime.recovered",
        ],
        "projectIds": [
            "6650a4c2e1b3d5f7a9c1e301",
        ],
    },
)
result = response.json()
if not response.ok:
    raise RuntimeError(f"{result['error']['code']}: {result['error']['message']}")
print(result["data"])

const crypto = require('crypto');

// rawBody: the request body exactly as received (string or Buffer).
function verifyTracker(rawBody, header, secret, toleranceSec = 300) {
  const parts = Object.fromEntries(
    String(header || '').split(',').map((p) => p.split('=', 2))
  );
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > toleranceSec) return false;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${t}.${rawBody}`)
    .digest('hex');
  const given = Buffer.from(parts.v1 || '', 'hex');
  const want = Buffer.from(expected, 'hex');
  return given.length === want.length && crypto.timingSafeEqual(given, want);
}

// Express: read the raw body so the signature matches byte for byte.
app.post('/hooks/tracker', express.raw({ type: 'application/json' }), (req, res) => {
  const ok = verifyTracker(
    req.body.toString('utf8'),
    req.get('Tracker-Signature'),
    process.env.TRACKER_WEBHOOK_SECRET
  );
  if (!ok) return res.sendStatus(401);

  const event = JSON.parse(req.body);
  res.sendStatus(204); // reply within 10 seconds, then do the work
  handleEvent(event); // e.g. dedupe on event.id, then notify your team
});

import hashlib
import hmac
import time


def verify_tracker(raw_body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    """raw_body: the request body exactly as received."""
    parts = dict(p.split("=", 1) for p in (header or "").split(",") if "=" in p)
    try:
        t = int(parts["t"])
    except (KeyError, ValueError):
        return False
    if abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts.get("v1", ""))


# Flask
@app.post("/hooks/tracker")
def tracker_hook():
    if not verify_tracker(
        request.get_data(),
        request.headers.get("Tracker-Signature", ""),
        os.environ["TRACKER_WEBHOOK_SECRET"],
    ):
        abort(401)
    event = request.get_json()
    handle_event(event)  # keep it fast: reply within 10 seconds
    return "", 204