PathlyTry Flow

Integration

HMAC-signed outbound webhooks

run.failed / run.recovered events, X-Pathly-* headers and signature verification.

OpenAPI contractIssue an API keyFree Solo account

Full document, no authentication, ready for your client generator.

Outbound webhooks

Supported events: run.failed, run.recovered. Headers: X-Pathly-Id, X-Pathly-Event, X-Pathly-Timestamp, X-Pathly-Signature (HMAC-SHA256 of `${timestamp}.${rawBody}`, sha256= prefix). URL stays encrypted at rest; reads expose a fingerprint.

Verify the signature in constant time (timingSafeEqual). Reject stale timestamps (replay). Return 2xx quickly; process asynchronously.

Créer

curl -X POST https://api.pathlyhq.com/v1/webhooks \
  -H "Authorization: Bearer $PATHLY_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://www.example.com/hooks/pathly",
    "events": ["run.failed", "run.recovered"]
  }'

Node — vérifier la signature

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(secret, timestamp, rawBody, signature) {
  const expected =
    "sha256=" +
    createHmac("sha256", secret)
      .update(`${timestamp}.${rawBody}`)
      .digest("hex");
  const a = Buffer.from(signature);
  const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

Python — vérifier la signature

import hashlib, hmac

def verify(secret: str, timestamp: str, raw_body: bytes, signature: str) -> bool:
    digest = hmac.new(
        secret.encode(), f"{timestamp}.".encode() + raw_body, hashlib.sha256
    ).hexdigest()
    expected = f"sha256={digest}"
    return hmac.compare_digest(expected, signature)