Webhooks

curl -sS https://app.syntic.ai/v1/webhooks \
  -H "Authorization: Bearer $SYNTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -H "syntic-beta: webhooks-2026-11-01" \
  -d '{"url": "https://hooks.example.com/syntic",
       "events": ["batch.completed", "session.requires_action", "deployment.run.failed"]}'

const res = await fetch('https://app.syntic.ai/v1/webhooks', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.SYNTIC_API_KEY}`,
    'Content-Type': 'application/json',
    'syntic-beta': 'webhooks-2026-11-01',
  },
  body: JSON.stringify({
    url: 'https://hooks.example.com/syntic',
    events: ['batch.completed', 'session.requires_action', 'deployment.run.failed'],
  }),
})
const hook = await res.json()
console.log(hook.id, hook.signing_secret) // store the secret now

import os, requests
 
hook = requests.post(
    "https://app.syntic.ai/v1/webhooks",
    headers={"Authorization": f"Bearer {os.environ['SYNTIC_API_KEY']}", "syntic-beta": "webhooks-2026-11-01"},
    json={"url": "https://hooks.example.com/syntic",
          "events": ["batch.completed", "session.requires_action", "deployment.run.failed"]},
).json()
print(hook["id"], hook["signing_secret"])  # store the secret now

import crypto from 'node:crypto'
import express from 'express'
 
const app = express()
app.post('/syntic', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('syntic-signature') ?? ''
  const parts = Object.groupBy(header.split(','), (p) => p.split('=')[0])
  const t = parts.t?.[0]?.slice(2)
  const sigs = (parts.v1 ?? []).map((p) => p.slice(3))
  const expected = crypto
    .createHmac('sha256', process.env.SYNTIC_WEBHOOK_SECRET)
    .update(`${t}.${req.body}`)
    .digest('hex')
  const fresh = Math.abs(Date.now() / 1000 - Number(t)) < 300
  const ok = fresh && sigs.some((s) => s.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(s), Buffer.from(expected)))
  if (!ok) return res.sendStatus(400)
 
  const event = JSON.parse(req.body)
  queue.push(event)          // do the work later
  res.sendStatus(200)        // answer fast
})

import hmac, hashlib, json, os, time
from flask import Flask, request, abort
 
app = Flask(__name__)
SECRET = os.environ["SYNTIC_WEBHOOK_SECRET"].encode()
 
@app.post("/syntic")
def syntic():
    header = request.headers.get("syntic-signature", "")
    items = [p.split("=", 1) for p in header.split(",") if "=" in p]
    t = next((v for k, v in items if k == "t"), None)
    sigs = [v for k, v in items if k == "v1"]
    body = request.get_data()
    expected = hmac.new(SECRET, f"{t}.".encode() + body, hashlib.sha256).hexdigest()
    if not t or abs(time.time() - int(t)) > 300 or not any(hmac.compare_digest(s, expected) for s in sigs):
        abort(400)
    event = json.loads(body)
    enqueue(event)   # do the work later
    return "", 200

# Recompute a signature by hand to debug verification code
T=1762300800
BODY='{"id":"evt_01JCA5D7F9H1K3M5P7R9","type":"webhook.test"}'
printf '%s.%s' "$T" "$BODY" | openssl dgst -sha256 -hmac "$SYNTIC_WEBHOOK_SECRET" -hex