Webhooks

curl -X POST "https://api.wolvy.net/v1/webhook-endpoints" \
  -H "Authorization: Bearer $WOLVY_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 5b6f1c2e-9a0d-4f3e-8c71-2d4b6a9e0f13" \
  -d '{
    "url": "https://example.com/hooks/wolvy",
    "events": [
      "video.ready",
      "video.failed"
    ]
  }'

import { randomUUID } from "node:crypto";

const res = await fetch("https://api.wolvy.net/v1/webhook-endpoints", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.WOLVY_API_KEY}`,
    "Content-Type": "application/json",
    "Idempotency-Key": randomUUID(), // reuse the same key when you retry
  },
  body: JSON.stringify({
    url: "https://example.com/hooks/wolvy",
    events: ["video.ready", "video.failed"],
  }),
});
const endpoint = await res.json();
if (!res.ok) throw new Error(`${res.status} ${endpoint.error.code}`);

import os
import uuid

import requests

res = requests.post(
    "https://api.wolvy.net/v1/webhook-endpoints",
    headers={
        "Authorization": f"Bearer {os.environ['WOLVY_API_KEY']}",
        "Idempotency-Key": str(uuid.uuid4()),  # reuse the same key when you retry
    },
    json={
        "url": "https://example.com/hooks/wolvy",
        "events": ["video.ready", "video.failed"],
    },
    timeout=30,
)
endpoint = res.json()
if not res.ok:
    raise RuntimeError(f"{res.status_code} {endpoint['error']['code']}")

<?php
$ch = curl_init('https://api.wolvy.net/v1/webhook-endpoints');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . getenv('WOLVY_API_KEY'),
        'Content-Type: application/json',
        'Idempotency-Key: ' . bin2hex(random_bytes(16)), // reuse the same key when you retry
    ],
    CURLOPT_POSTFIELDS     => json_encode([
        'url'    => 'https://example.com/hooks/wolvy',
        'events' => ['video.ready', 'video.failed'],
    ]),
]);
$endpoint = json_decode(curl_exec($ch), true);
$status   = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
if ($status >= 400) {
    throw new RuntimeException("$status {$endpoint['error']['code']}");
}

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.WOLVY_WEBHOOK_SECRET; // whsec_…

export function verifyWolvySignature(rawBody, header, secret, now = Math.floor(Date.now() / 1000)) {
  let t = "", v1 = "";
  for (const part of String(header ?? "").split(",")) {
    const i = part.indexOf("=");
    if (i === -1) continue;
    const key = part.slice(0, i).trim();
    const value = part.slice(i + 1).trim();
    if (key === "t") t = value;
    if (key === "v1") v1 = value;
  }
  if (!/^\d+$/.test(t) || !v1 || Math.abs(now - Number(t)) > 300) return false;
  const expected = crypto.createHmac("sha256", secret).update(`${t}.`).update(rawBody).digest("hex");
  return expected.length === v1.length && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}

// express.raw keeps the exact bytes — express.json() would re-serialise them.
app.post("/hooks/wolvy", express.raw({ type: "application/json" }), (req, res) => {
  if (!verifyWolvySignature(req.body, req.get("Wolvy-Signature"), SECRET)) {
    return res.sendStatus(400);
  }
  const event = JSON.parse(req.body); // parse only after verifying
  res.sendStatus(200);                // acknowledge within 15 s…
  handleEvent(event);                 // …then do the work (dedupe on event.id)
});

<?php
function wolvy_verify_signature(string $raw, string $header, string $secret, ?int $now = null): bool
{
    $t = $v1 = '';
    foreach (explode(',', $header) as $part) {
        [$key, $value] = array_pad(explode('=', trim($part), 2), 2, '');
        if ($key === 't')  { $t = $value; }
        if ($key === 'v1') { $v1 = $value; }
    }
    if (!ctype_digit($t) || $v1 === '' || abs(($now ?? time()) - (int) $t) > 300) {
        return false;
    }
    return hash_equals(hash_hmac('sha256', $t . '.' . $raw, $secret), $v1);
}

$raw    = file_get_contents('php://input');             // the raw body, before json_decode
$header = $_SERVER['HTTP_WOLVY_SIGNATURE'] ?? '';

if (!wolvy_verify_signature($raw, $header, getenv('WOLVY_WEBHOOK_SECRET'))) {
    http_response_code(400);
    exit;
}

$event = json_decode($raw, true);
http_response_code(200);
// Queue the work — dedupe on $event['id'] — rather than doing it here.

import hashlib
import hmac
import os
import time

from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["WOLVY_WEBHOOK_SECRET"]  # whsec_…


def verify_wolvy_signature(raw, header, secret, now=None):
    parts = dict(p.strip().split("=", 1) for p in (header or "").split(",") if "=" in p)
    t, v1 = parts.get("t", ""), parts.get("v1", "")
    if not (t.isascii() and t.isdigit()) or not v1:
        return False
    if abs((int(time.time()) if now is None else now) - int(t)) > 300:
        return False
    expected = hmac.new(secret.encode(), t.encode() + b"." + raw, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)


@app.post("/hooks/wolvy")
def wolvy_webhook():
    if not verify_wolvy_signature(request.get_data(), request.headers.get("Wolvy-Signature", ""), SECRET):
        abort(400)
    event = request.get_json()  # parse only after verifying
    # enqueue the work, deduplicated on event["id"]
    return "", 200

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"io"
	"log"
	"net/http"
	"os"
	"strconv"
	"strings"
	"time"
)

type WolvyEvent struct {
	ID        string          `json:"id"`
	Type      string          `json:"type"`
	CreatedAt string          `json:"created_at"`
	Data      json.RawMessage `json:"data"`
}

func verifyWolvySignature(raw []byte, header, secret string, now time.Time) bool {
	var t, v1 string
	for _, part := range strings.Split(header, ",") {
		key, value, ok := strings.Cut(strings.TrimSpace(part), "=")
		if !ok {
			continue
		}
		switch key {
		case "t":
			t = value
		case "v1":
			v1 = value
		}
	}
	ts, err := strconv.ParseInt(t, 10, 64)
	if err != nil || v1 == "" {
		return false
	}
	if age := now.Unix() - ts; age > 300 || age < -300 {
		return false
	}
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(t + "."))
	mac.Write(raw)
	return hmac.Equal([]byte(hex.EncodeToString(mac.Sum(nil))), []byte(v1))
}

func wolvyWebhook(w http.ResponseWriter, r *http.Request) {
	raw, err := io.ReadAll(io.LimitReader(r.Body, 1<<20))
	if err != nil || !verifyWolvySignature(raw, r.Header.Get("Wolvy-Signature"), os.Getenv("WOLVY_WEBHOOK_SECRET"), time.Now()) {
		http.Error(w, "invalid signature", http.StatusBadRequest)
		return
	}
	var event WolvyEvent
	if err := json.Unmarshal(raw, &event); err != nil {
		http.Error(w, "invalid body", http.StatusBadRequest)
		return
	}
	w.WriteHeader(http.StatusOK)
	go handleEvent(event) // your code: dedupe on event.ID, then act on event.Type
}

func handleEvent(event WolvyEvent) { log.Printf("wolvy %s %s", event.ID, event.Type) }

func main() {
	http.HandleFunc("/hooks/wolvy", wolvyWebhook)
	log.Fatal(http.ListenAndServe(":8080", nil))
}

// processed_events(event_id TEXT PRIMARY KEY, received_at TIMESTAMP)
async function handleEvent(event) {
  const inserted = await db.query(
    "INSERT INTO processed_events (event_id, received_at) VALUES ($1, now()) ON CONFLICT DO NOTHING",
    [event.id],
  );
  if (inserted.rowCount === 0) return; // seen before — a retry or a duplicate

  switch (event.type) {
    case "video.ready":
      await markLessonPublished(event.data.id);
      break;
    case "video.failed":
      await alertContentTeam(event.data.id, event.data.error ?? "encoding failed");
      break;
  }
}

<?php
// processed_events(event_id VARCHAR(40) PRIMARY KEY, received_at DATETIME)
function handle_wolvy_event(PDO $db, array $event): void
{
    $insert = $db->prepare('INSERT IGNORE INTO processed_events (event_id, received_at) VALUES (?, NOW())');
    $insert->execute([$event['id']]);
    if ($insert->rowCount() === 0) {
        return; // seen before — a retry or a duplicate
    }

    switch ($event['type']) {
        case 'video.ready':
            mark_lesson_published($event['data']['id']);
            break;
        case 'video.failed':
            alert_content_team($event['data']['id'], $event['data']['error'] ?? 'encoding failed');
            break;
    }
}

curl -X PATCH "https://api.wolvy.net/v1/webhook-endpoints/3" \
  -H "Authorization: Bearer $WOLVY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "is_active": true
  }'

const res = await fetch("https://api.wolvy.net/v1/webhook-endpoints/3", {
  method: "PATCH",
  headers: {
    Authorization: `Bearer ${process.env.WOLVY_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    is_active: true,
  }),
});
const endpoint = await res.json();
if (!res.ok) throw new Error(`${res.status} ${endpoint.error.code}`);

import os

import requests

res = requests.patch(
    "https://api.wolvy.net/v1/webhook-endpoints/3",
    headers={"Authorization": f"Bearer {os.environ['WOLVY_API_KEY']}"},
    json={"is_active": True},
    timeout=30,
)
endpoint = res.json()
if not res.ok:
    raise RuntimeError(f"{res.status_code} {endpoint['error']['code']}")

<?php
$ch = curl_init('https://api.wolvy.net/v1/webhook-endpoints/3');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST  => 'PATCH',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . getenv('WOLVY_API_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS     => json_encode([
        'is_active' => true,
    ]),
]);
$endpoint = json_decode(curl_exec($ch), true);
$status   = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
if ($status >= 400) {
    throw new RuntimeException("$status {$endpoint['error']['code']}");
}

curl -X POST "https://api.wolvy.net/v1/webhook-endpoints/3/test" \
  -H "Authorization: Bearer $WOLVY_API_KEY" \
  -H "Idempotency-Key: 5b6f1c2e-9a0d-4f3e-8c71-2d4b6a9e0f13"

import { randomUUID } from "node:crypto";

const res = await fetch("https://api.wolvy.net/v1/webhook-endpoints/3/test", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.WOLVY_API_KEY}`,
    "Idempotency-Key": randomUUID(), // reuse the same key when you retry
  },
});
const delivery = await res.json();
if (!res.ok) throw new Error(`${res.status} ${delivery.error.code}`);

import os
import uuid

import requests

res = requests.post(
    "https://api.wolvy.net/v1/webhook-endpoints/3/test",
    headers={
        "Authorization": f"Bearer {os.environ['WOLVY_API_KEY']}",
        "Idempotency-Key": str(uuid.uuid4()),  # reuse the same key when you retry
    },
    timeout=30,
)
delivery = res.json()
if not res.ok:
    raise RuntimeError(f"{res.status_code} {delivery['error']['code']}")

<?php
$ch = curl_init('https://api.wolvy.net/v1/webhook-endpoints/3/test');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . getenv('WOLVY_API_KEY'),
        'Idempotency-Key: ' . bin2hex(random_bytes(16)), // reuse the same key when you retry
    ],
    CURLOPT_POSTFIELDS     => '',
]);
$delivery = json_decode(curl_exec($ch), true);
$status   = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
if ($status >= 400) {
    throw new RuntimeException("$status {$delivery['error']['code']}");
}