Webhooks API

curl -X POST "https://api.cribscore.co/v1/webhooks" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "facility_id": "fac_01HZ8X9K2D7N3M5P0AYR4FTC2W",
    "callback_url": "https://automation.example.com/cribscore",
    "events": ["score_change", "license_change", "violation_recorded"]
  }'

import httpx

response = httpx.post(
    "https://api.cribscore.co/v1/webhooks",
    headers={
        "Authorization": "Bearer YOUR_API_KEY",
        "Content-Type": "application/json",
    },
    json={
        "facility_id": "fac_01HZ8X9K2D7N3M5P0AYR4FTC2W",
        "callback_url": "https://automation.example.com/cribscore",
        "events": ["score_change", "license_change", "violation_recorded"],
    },
    timeout=30.0,
)
response.raise_for_status()
print(response.json())

import crypto from "node:crypto";

const SIGNING_SECRET = process.env.CRIBSCORE_WEBHOOK_SECRET ?? "";

export function verifyCribscoreSignature(rawBody: string, header: string): boolean {
  const expected = crypto
    .createHmac("sha256", SIGNING_SECRET)
    .update(rawBody)
    .digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(header.replace(/^sha256=/, ""), "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

import hmac
import hashlib

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    received = header.removeprefix("sha256=")
    return hmac.compare_digest(expected, received)