PathlyProbar Flow

Integración

Webhooks salientes firmados HMAC

Eventos run.failed / run.recovered, cabeceras X-Pathly-* y verificación de firma.

Contrato OpenAPIEmitir una clave de APICuenta Solo gratis

Documento completo, sin autenticación, listo para su generador de clientes.

Webhooks salientes

Eventos: run.failed, run.recovered. Cabeceras X-Pathly-* con firma HMAC-SHA256. La URL permanece cifrada; la lectura expone una huella.

Verifique la firma en tiempo constante. Rechace timestamps antiguos. Responda 2xx rápido y procese en cola.

Créer

curl -X POST https://api.pathlyhq.com/v1/webhooks \
  -H "Authorization: Bearer $PATHLY_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://www.example.com/hooks/pathly",
    "events": ["run.failed", "run.recovered"]
  }'

Node — vérifier la signature

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(secret, timestamp, rawBody, signature) {
  const expected =
    "sha256=" +
    createHmac("sha256", secret)
      .update(`${timestamp}.${rawBody}`)
      .digest("hex");
  const a = Buffer.from(signature);
  const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

Python — vérifier la signature

import hashlib, hmac

def verify(secret: str, timestamp: str, raw_body: bytes, signature: str) -> bool:
    digest = hmac.new(
        secret.encode(), f"{timestamp}.".encode() + raw_body, hashlib.sha256
    ).hexdigest()
    expected = f"sha256={digest}"
    return hmac.compare_digest(expected, signature)