Webhooks

import httpx

resp = httpx.post(
    "https://api.mandatelabs.ai/api/v1/webhooks",
    headers={"X-API-Key": "mdt_live_…"},
    json={
        "url": "https://your-app.com/webhooks/mandate-ai",
        "event_types": ["gate.fired", "kya.zone.red", "kya.zone.critical", "authorization.decline"],
        "description": "Production alerting",
    },
)
data = resp.json()

print(f"ID: {data['webhook']['id']}")
print(f"Secret: {data['signing_secret']}")  # whsec_... — save securely!

const resp = await fetch("https://api.mandatelabs.ai/api/v1/webhooks", {
  method: "POST",
  headers: { "X-API-Key": "mdt_live_…", "Content-Type": "application/json" },
  body: JSON.stringify({
    url: "https://your-app.com/webhooks/mandate-ai",
    event_types: ["gate.fired", "kya.zone.red", "kya.zone.critical", "authorization.decline"],
    description: "Production alerting",
  }),
});
const data = await resp.json();

console.log(`ID: ${data.webhook.id}`);
console.log(`Secret: ${data.signing_secret}`); // whsec_... — save securely!

import crypto from "crypto";
import express from "express";

function verifyWebhook(rawBody, signatureHeader, secret) {
  // X-Mandate-Signature is "sha256=" + hex HMAC-SHA256 of the raw request body
  const expected = "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signatureHeader || "");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

const app = express();
const WEBHOOK_SECRET = "whsec_your_secret_here";
const seenIds = new Set(); // use a durable store in production

app.post("/webhooks/mandate-ai", express.raw({ type: "application/json" }), (req, res) => {
  if (!verifyWebhook(req.body, req.headers["x-mandate-signature"], WEBHOOK_SECRET)) {
    return res.status(401).json({ error: "invalid signature" });
  }
  const event = JSON.parse(req.body.toString());
  if (Math.abs(Date.now() - Date.parse(event.timestamp)) > 5 * 60 * 1000) {
    return res.status(400).json({ error: "stale event" }); // possible replay
  }
  if (seenIds.has(event.id)) {
    return res.status(200).json({ received: true }); // duplicate delivery, already handled
  }
  seenIds.add(event.id);
  console.log(`Received ${event.event} for agent ${event.data.agent_id}`);
  res.status(200).json({ received: true });
});

import httpx

# Send a test ping to your webhook endpoint
resp = httpx.post(
    "https://api.mandatelabs.ai/api/v1/webhooks/wh_abc123/test",
    headers={"X-API-Key": "mdt_live_…"},
    params={"event_type": "gate.fired"},
)
print(f"Test result: {resp.json()}")  # {"status": "sent", "event_type": "gate.fired", ...}

// Send a test ping to your webhook endpoint
const resp = await fetch(
  "https://api.mandatelabs.ai/api/v1/webhooks/wh_abc123/test?event_type=gate.fired",
  { method: "POST", headers: { "X-API-Key": "mdt_live_…" } },
);
console.log(`Test result: ${JSON.stringify(await resp.json())}`); // {"status":"sent",...}