curl -X POST https://api.pricklymails.com/api/webhooks \
  -H "Authorization: Bearer <dashboard-jwt-access-token>" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/webhooks/pricklymails", "events": ["job.completed", "job.failed"]}'

HTTP/1.1 201 Created

{
  "uuid": "018f2c3a-6b91-7c44-9c2e-1a2b3c4d5e70",
  "url": "https://example.com/webhooks/pricklymails",
  "events": ["job.completed", "job.failed"],
  "status": "active",
  "total_deliveries": 0,
  "successful_deliveries": 0,
  "consecutive_failures": 0,
  "created_at": "2026-07-02T10:00:00Z",
  "secret": "6f2c1e4a9b7d3f0851c6a2e4d8b7f102c9a4e6f0b3d7185ac2e6f4a9b7d3f08"
}

POST https://example.com/webhooks/pricklymails HTTP/1.1
Content-Type: application/json
X-PricklyMails-Event: job.completed
X-PricklyMails-Signature: t=1751500000,v1=5257a869e7bff7a97d0731ff6dd9c1c3f9a3d1e69f0b7f6a1d3d3f6a4c8f9b2e

{
  "event": "job.completed",
  "job_uuid": "018f2c3a-6b91-7c44-9c2e-1a2b3c4d5e6f",
  "status": "completed",
  "timestamp": 1751500000
}

const crypto = require('crypto')

function verifyWebhookSignature(rawBody, signatureHeader, secret, toleranceSeconds = 288) {
  const parts = Object.fromEntries(signatureHeader.split(',').map((part) => part.split('=')))
  const timestamp = Number(parts.t)
  const expected = parts.v1

  if (!timestamp || !expected) {
    throw new Error('malformed signature header')
  }

  const age = Math.abs(Math.floor(Date.now() / 1000) - timestamp)
  if (age > toleranceSeconds) {
    throw new Error('signature timestamp too old')
  }

  const signedPayload = `${timestamp}.${rawBody}`
  const computed = crypto.createHmac('sha256', secret).update(signedPayload).digest('hex')

  const a = Buffer.from(computed, 'hex')
  const b = Buffer.from(expected, 'hex')
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    throw new Error('signature mismatch')
  }
}