Webhook

{
  "version": 1,
  "event": "alert.firing",
  "deliveryId": "6f1c…",
  "sentAt": "2026-10-17T12:00:00Z",
  "alert": {
    "id": "0b8e…",
    "url": "https://…/alerts/0b8e…",
    "severity": "critical",
    "ruleId": "c2d1…",
    "ruleName": "Liquidity outflow",
    "project": { "id": "4a7f…", "name": "Vault" },
    "contract": { "network": "ethereum", "address": "0xabc…", "name": "Pool" },
    "labels": { "token": "USDC" },
    "condition": "gt",
    "value": 1250000,
    "threshold": 1000000,
    "band": null,
    "conditions": null,
    "startedAt": "2026-10-17T11:58:00Z",
    "resolvedAt": null
  }
}

signature = hex( HMAC-SHA256( secret, timestamp + "." + rawBody ) )
X-SmartAlert-Signature: sha256=<signature>

import crypto from "node:crypto";
import express from "express";

const SECRET = process.env.SMARTALERT_SECRET; // whsec_…

function verify(secret, headers, rawBody) {
  const ts = headers["x-smartalert-timestamp"];
  const got = headers["x-smartalert-signature"];
  if (!ts || !got || !Number.isFinite(Number(ts))) return false;
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const mac = crypto.createHmac("sha256", secret).update(`${ts}.`).update(rawBody).digest("hex");
  const a = Buffer.from(got);
  const b = Buffer.from(`sha256=${mac}`);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

const app = express();
app.post("/smartalert", express.raw({ type: "application/json" }), (req, res) => {
  if (!verify(SECRET, req.headers, req.body)) return res.sendStatus(401);
  const event = JSON.parse(req.body.toString("utf8"));
  // Drop duplicates by event.deliveryId and process asynchronously.
  res.sendStatus(200);
});
app.listen(3000);

import hashlib
import hmac
import time

def verify(secret: str, headers, raw_body: bytes) -> bool:
    ts = headers.get("X-SmartAlert-Timestamp", "")
    got = headers.get("X-SmartAlert-Signature", "")
    try:
        if abs(time.time() - int(ts)) > 300:
            return False
    except ValueError:
        return False
    mac = hmac.new(secret.encode(), ts.encode() + b"." + raw_body, hashlib.sha256)
    return hmac.compare_digest("sha256=" + mac.hexdigest(), got)