Webhooks

Be told when a task waits, records evidence, or finishes.

POST https://api.phronen.ai/api/v1/webhooksjson

{
  "url": "https://ci.example.com/phronen",
  "events": ["task.approval", "task.done"]
}

The response includes the signing secret once. Targets must be HTTPS and may not point at private networks. Events: task.stage, task.evidence, task.approval, task.done, task.log, or task.* for all of them.

Verifying a delivery

Each delivery carries an X-Phronen-Signature header of the form t=<unix seconds>,v1=<hex>. Compute HMAC-SHA256 over "<t>.<raw body>" with your secret and compare with v1 in constant time; reject stale timestamps.

import hmac, hashlib

def verify(secret: str, header: str, body: bytes) -> bool:
    parts = dict(kv.split("=", 1) for kv in header.split(","))
    mac = hmac.new(secret.encode(), f"{parts['t']}.".encode() + body, hashlib.sha256)
    return hmac.compare_digest(mac.hexdigest(), parts["v1"])

GET https://api.phronen.ai/api/v1/webhooks/{id}/deliveries   # what was sent, the response code, retries

Was this page helpful?

PreviousDevices Next Credits