Webhook Endpoints

GET /api/v1/org/webhooks

[
  {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "url": "https://example.com/hooks/grantiva",
    "events": ["attestation.completed", "risk_threshold_exceeded"],
    "isActive": true,
    "description": "Production event receiver",
    "createdAt": "2026-03-01T12:00:00Z",
    "updatedAt": "2026-03-10T08:30:00Z"
  }
]

POST /api/v1/org/webhooks

{
  "url": "https://example.com/hooks/grantiva",
  "events": ["attestation.completed", "risk_threshold_exceeded"],
  "description": "Production event receiver"
}

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "url": "https://example.com/hooks/grantiva",
  "events": ["attestation.completed"],
  "isActive": true,
  "description": "Production event receiver",
  "secret": "whsec_abc123...",
  "createdAt": "2026-03-01T12:00:00Z"
}

PATCH /api/v1/org/webhooks/:id

{
  "isActive": false,
  "events": ["attestation.completed", "device_blocked"],
  "description": "Updated label"
}

DELETE /api/v1/org/webhooks/:id

import CryptoKit

func isValidSignature(payload: Data, signature: String, secret: String) -> Bool {
    guard let secretData = secret.data(using: .utf8) else { return false }
    let key = SymmetricKey(data: secretData)
    let mac = HMAC<SHA256>.authenticationCode(for: payload, using: key)
    let expected = "sha256=" + Data(mac).map { String(format: "%02x", $0) }.joined()
    return expected == signature
}