Sandbox webhooks

curl -X POST https://api.sandbox.stateset.app/api/webhooks \
  -H "Authorization: ApiKey sk_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.com/webhooks/sandbox",
    "events": ["sandbox.ready", "command.completed", "command.failed", "sandbox.stopped"],
    "secret": "whsec_your_webhook_secret",
    "retry_count": 3,
    "retry_delay_ms": 1000,
    "timeout_ms": 30000
  }'

import { StateSetSandbox } from '@stateset/sandbox-sdk';

const sdk = new StateSetSandbox({ apiKey: 'sk_your_api_key' });

const webhook = await sdk.webhooks.create({
  url: 'https://your-app.com/webhooks/sandbox',
  events: ['sandbox.ready', 'command.completed', 'command.failed', 'sandbox.stopped'],
  secret: 'whsec_your_webhook_secret',
  retry_count: 3,
});

from stateset_sandbox import StateSetSandbox

sdk = StateSetSandbox(api_key="sk_your_api_key")

webhook = sdk.webhooks.create(
    url="https://your-app.com/webhooks/sandbox",
    events=["sandbox.ready", "command.completed", "command.failed", "sandbox.stopped"],
    secret="whsec_your_webhook_secret",
    retry_count=3,
)

const crypto = require('crypto');

function verify(rawBody, signature, secret) {
  const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

app.post('/webhooks/sandbox', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verify(req.body, req.headers['x-webhook-signature'] || '', process.env.WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  const event = JSON.parse(req.body);
  res.status(200).json({ received: true });
});

import hmac, hashlib

def verify(raw_body: bytes, signature: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(signature, expected)

@app.route("/webhooks/sandbox", methods=["POST"])
def webhook():
    if not verify(request.data, request.headers.get("X-Webhook-Signature", ""), WEBHOOK_SECRET):
        return {"error": "Invalid signature"}, 401
    return {"received": True}, 200

func verify(payload []byte, signature, secret string) bool {
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write(payload)
    expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(signature), []byte(expected))
}