Webhooks Quick Start

// Node.js / Express
const crypto = require('crypto');

// Capture the raw body for this route so the signature check sees the exact bytes.
app.post(
  '/webhooks/grantiva',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['x-grantiva-signature'];
    const expected =
      'sha256=' +
      crypto
        .createHmac('sha256', process.env.WEBHOOK_SECRET)
        .update(req.body)
        .digest('hex');

    const ok =
      signature &&
      signature.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));

    if (!ok) return res.status(401).send('Invalid signature');

    const { event, data } = JSON.parse(req.body.toString('utf8'));

    switch (event) {
      case 'device.high_risk':
        // Every value in `data` is a string — parse before comparing.
        console.log(`High risk device ${data.key_id} scored ${data.risk_score}`);
        flagDevice(data.key_id, Number(data.risk_score));
        break;
      case 'device.new':
        console.log(`New device ${data.key_id} (${data.device_model})`);
        break;
    }

    res.sendStatus(200);
  }
);

// Vapor
func handleWebhook(_ req: Request) throws -> HTTPStatus {
    let signature = req.headers.first(name: "X-Grantiva-Signature") ?? ""
    let body = req.body.data ?? ByteBuffer()

    let key = SymmetricKey(data: Data(Environment.get("WEBHOOK_SECRET")!.utf8))
    let mac = HMAC<SHA256>.authenticationCode(for: Data(buffer: body), using: key)
    let expected = "sha256=" + mac.map { String(format: "%02x", $0) }.joined()

    guard expected == signature else {
        throw Abort(.unauthorized)
    }

    let payload = try req.content.decode(WebhookPayload.self)

    switch payload.event {
    case "device.high_risk":
        // payload.data is [String: String]
        break
    default:
        break
    }

    return .ok
}