Webhooks

{
  "prompt": "a beautiful sunset over mountains",
  "model": "flux-2-klein-4b-bf16",
  "webhook_url": "https://your-server.com/webhooks/dryapi"
}

{
  "event": "job.processing",
  "delivery_id": "550e8400-e29b-41d4-a716-446655440000",
  "timestamp": "2024-01-15T10:30:00.000Z",
  "data": {
    "job_request_id": "123e4567-e89b-12d3-a456-426614174000",
    "status": "processing",
    "previous_status": "pending",
    "job_type": "txt2img",
    "started_at": "2024-01-15T10:30:00.000Z"
  }
}

{
  "event": "job.completed",
  "delivery_id": "550e8400-e29b-41d4-a716-446655440001",
  "timestamp": "2024-01-15T10:30:45.000Z",
  "data": {
    "job_request_id": "123e4567-e89b-12d3-a456-426614174000",
    "status": "done",
    "previous_status": "processing",
    "job_type": "txt2img",
    "completed_at": "2024-01-15T10:30:45.000Z",
    "result_url": "https://storage.dryapi.dev/results/.../output.png",
    "processing_time_ms": 45000
  }
}

{
  "event": "job.failed",
  "delivery_id": "550e8400-e29b-41d4-a716-446655440002",
  "timestamp": "2024-01-15T10:30:45.000Z",
  "data": {
    "job_request_id": "123e4567-e89b-12d3-a456-426614174000",
    "status": "error",
    "previous_status": "processing",
    "job_type": "txt2img",
    "failed_at": "2024-01-15T10:30:45.000Z",
    "error_code": "WORKER_TIMEOUT",
    "error_message": "Worker failed to respond within the allowed time"
  }
}

const crypto = require('crypto');

function verifyWebhook(req, secret) {
  const signature = req.headers['x-dryapi-signature'];
  const timestamp = req.headers['x-dryapi-timestamp'];
  const body = req.body.toString(); // Raw request body as string

  // Check timestamp is within 5 minutes
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) {
    return false; // Reject old requests (replay attack prevention)
  }

  // Calculate expected signature
  const message = `${timestamp}.${body}`;
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(message)
    .digest('hex');

  // Timing-safe comparison
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

import hmac
import hashlib
import time

def verify_webhook(headers, body, secret):
    signature = headers.get('X-DryAPI-Signature', '')
    timestamp = headers.get('X-DryAPI-Timestamp', '')

    # Check timestamp is within 5 minutes
    now = int(time.time())
    if abs(now - int(timestamp)) > 300:
        return False  # Reject old requests

    # Calculate expected signature
    message = f"{timestamp}.{body}"
    expected = 'sha256=' + hmac.new(
        secret.encode(),
        message.encode(),
        hashlib.sha256
    ).hexdigest()

    # Timing-safe comparison
    return hmac.compare_digest(signature, expected)

function verifyWebhook(array $headers, string $body, string $secret): bool
{
    $signature = $headers['X-DryAPI-Signature'] ?? '';
    $timestamp = $headers['X-DryAPI-Timestamp'] ?? '';

    // Check timestamp is within 5 minutes
    if (abs(time() - (int) $timestamp) > 300) {
        return false; // Reject old requests
    }

    // Calculate expected signature
    $message = $timestamp . '.' . $body;
    $expected = 'sha256=' . hash_hmac('sha256', $message, $secret);

    // Timing-safe comparison
    return hash_equals($expected, $signature);
}

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "math"
    "strconv"
    "time"
)

func verifyWebhook(signature, timestamp, body, secret string) bool {
    // Check timestamp is within 5 minutes
    ts, _ := strconv.ParseInt(timestamp, 10, 64)
    now := time.Now().Unix()
    if math.Abs(float64(now-ts)) > 300 {
        return false
    }

    // Calculate expected signature
    message := fmt.Sprintf("%s.%s", timestamp, body)
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(message))
    expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))

    // Timing-safe comparison
    return hmac.Equal([]byte(signature), []byte(expected))
}

// Example: Express.js endpoint
app.post('/webhooks/dryapi', express.raw({ type: 'application/json' }), (req, res) => {
  // Verify signature first
  if (!verifyWebhook(req, process.env.DRYAPI_WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body);

  // Respond immediately
  res.status(200).send('OK');

  // Process asynchronously
  processWebhookAsync(event);
});