Event webhooks

curl -s -X POST "https://wavefront.adwave.com/v1/workspaces/adwave/webhooks" \
  -H "Authorization: Bearer $WAVEFRONT_API_KEY" \
  -H "content-type: application/json" \
  -d '{"url":"https://example.com/wavefront","events":["version.approved","publication.published"],"description":"CMS sync"}'

{
  "type": "version.approved",
  "timestamp": "2026-10-12T14:00:00.000Z",
  "data": {
    "workspace": {
      "id": "ws_example",
      "slug": "acme",
      "name": "Acme"
    },
    "actor_id": "usr_example",
    "generation": {
      "id": "gen_example",
      "kind": "article",
      "title": "Google Ads cost benchmarks by industry",
      "content_id": "cnt_example"
    },
    "version_id": "ver_example",
    "decided_by": "usr_example",
    "via": "person",
    "links": {
      "app": "https://wavefront.adwave.com/w/acme/g/gen_example",
      "api": "https://wavefront.adwave.com/v1/workspaces/acme/generations/gen_example",
      "version": "https://wavefront.adwave.com/v1/workspaces/acme/versions/ver_example"
    }
  }
}

{
  "type": "publication.published",
  "timestamp": "2026-10-12T14:00:00.000Z",
  "data": {
    "workspace": {
      "id": "ws_example",
      "slug": "acme",
      "name": "Acme"
    },
    "actor_id": "usr_example",
    "publication": {
      "id": "pub_example",
      "slug": "google-ads-cost-benchmarks",
      "destination_id": "dst_example",
      "url": "https://example.com/google-ads-cost-benchmarks"
    },
    "version_id": "ver_example",
    "generation": {
      "id": "gen_example",
      "kind": "article",
      "title": "Google Ads cost benchmarks by industry",
      "content_id": "cnt_example"
    },
    "links": {
      "app": "https://wavefront.adwave.com/w/acme/g/gen_example",
      "api": "https://wavefront.adwave.com/v1/workspaces/acme/publications/pub_example"
    }
  }
}

{
  "type": "schedule.cancel_required",
  "timestamp": "2026-10-12T14:00:00.000Z",
  "data": {
    "workspace": {
      "id": "ws_example",
      "slug": "acme",
      "name": "Acme"
    },
    "actor_id": "usr_example",
    "subject_id": "sch_example"
  }
}

// npm install standardwebhooks
import { Webhook } from "standardwebhooks";

const event = new Webhook(process.env.WAVEFRONT_WEBHOOK_SECRET).verify(rawBody, headers);

import crypto from "node:crypto";

/** True when a delivery is from Wavefront: pass the raw body, the headers and the whsec_ secret. */
export function verifyWavefront(rawBody, headers, secret, toleranceSeconds = 300) {
  const id = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];
  const signatures = String(headers["webhook-signature"] ?? "").split(" ");
  if (!id || !/^\d+$/.test(String(timestamp ?? ""))) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > toleranceSeconds) return false;

  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const expected = crypto
    .createHmac("sha256", key)
    .update(`${id}.${timestamp}.${rawBody}`)
    .digest();
  return signatures.some((part) => {
    const [version, signature] = part.split(",");
    if (version !== "v1" || !signature) return false;
    const given = Buffer.from(signature, "base64");
    return given.length === expected.length && crypto.timingSafeEqual(given, expected);
  });
}

import express from "express";
import { verifyWavefront } from "./verify-wavefront.js";

const app = express();
// Verify against the exact bytes Wavefront sent, before any JSON parsing.
app.post("/wavefront", express.raw({ type: "application/json" }), (req, res) => {
  const raw = req.body.toString("utf8");
  if (!verifyWavefront(raw, req.headers, process.env.WAVEFRONT_WEBHOOK_SECRET)) {
    return res.status(401).end();
  }
  const event = JSON.parse(raw);
  // Deliveries can repeat: skip a webhook-id you have already handled.
  res.status(204).end();
  handle(req.headers["webhook-id"], event);
});

import base64
import hashlib
import hmac
import time


def verify_wavefront(raw_body: bytes, headers, secret: str, tolerance_seconds: int = 300) -> bool:
    """True when a delivery is from Wavefront: pass the raw body, the headers and the whsec_ secret."""
    msg_id = headers.get("webhook-id", "")
    timestamp = headers.get("webhook-timestamp", "")
    if not msg_id or not timestamp.isdigit():
        return False
    if abs(time.time() - int(timestamp)) > tolerance_seconds:
        return False

    key = base64.b64decode(secret.removeprefix("whsec_"))
    signed = f"{msg_id}.{timestamp}.".encode() + raw_body
    expected = base64.b64encode(hmac.new(key, signed, hashlib.sha256).digest()).decode()
    for part in headers.get("webhook-signature", "").split(" "):
        version, _, signature = part.partition(",")
        if version == "v1" and hmac.compare_digest(signature, expected):
            return True
    return False