Webhooks

curl -X POST https://api.trycactus.com/v1/webhook-endpoints \
  -H "Authorization: Bearer $CACTUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/cactus/webhooks", "events": ["extraction.completed", "extraction.failed"]}'

Cactus-Signature: t=1720000000,v1=5257a869e7...

import hashlib, hmac, time

def verify(secret: str, body: bytes, header: str, tolerance: int = 300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    ts, provided = int(parts["t"]), parts["v1"]
    if abs(time.time() - ts) > tolerance:
        return False  # too old — possible replay
    expected = hmac.new(secret.encode(), f"{ts}.".encode() + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, provided)