API Webhooks

$payload = json_encode([
    'url'            => 'https://example.com/hooks/argo',
    'enabled_events' => ['revenue.imported', 'revenue.rejected'],
    'description'    => 'Production',
]);

$ch = curl_init('https://argorobots.com/v1/webhook_endpoints');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $payload,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ab_...',
        'Content-Type: application/json',
        'Idempotency-Key: hook-1',
    ],
]);

$endpoint = json_decode(curl_exec($ch), true);

// The only time signing_secret is ever returned. Store it now.
echo $endpoint['signing_secret'];

using var http = new HttpClient();
http.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", "ab_...");

using var request = new HttpRequestMessage(
    HttpMethod.Post, "https://argorobots.com/v1/webhook_endpoints")
{
    Content = JsonContent.Create(new
    {
        url = "https://example.com/hooks/argo",
        enabled_events = new[] { "revenue.imported", "revenue.rejected" },
        description = "Production",
    }),
};
request.Headers.Add("Idempotency-Key", "hook-1");

using var response = await http.SendAsync(request);
var endpoint = await response.Content.ReadFromJsonAsync<JsonElement>();

// The only time signing_secret is ever returned. Store it now.
Console.WriteLine(endpoint.GetProperty("signing_secret").GetString());

const res = await fetch("https://argorobots.com/v1/webhook_endpoints", {
  method: "POST",
  headers: {
    Authorization: "Bearer ab_...",
    "Content-Type": "application/json",
    "Idempotency-Key": "hook-1",
  },
  body: JSON.stringify({
    url: "https://example.com/hooks/argo",
    enabled_events: ["revenue.imported", "revenue.rejected"],
    description: "Production",
  }),
});

const endpoint = await res.json();

// The only time signing_secret is ever returned. Store it now.
console.log(endpoint.signing_secret);

import requests

endpoint = requests.post(
    "https://argorobots.com/v1/webhook_endpoints",
    headers={
        "Authorization": "Bearer ab_...",
        "Idempotency-Key": "hook-1",
    },
    json={
        "url": "https://example.com/hooks/argo",
        "enabled_events": ["revenue.imported", "revenue.rejected"],
        "description": "Production",
    },
).json()

# The only time signing_secret is ever returned. Store it now.
print(endpoint["signing_secret"])

static bool ArgoSignatureIsValid(string body, string header, string secret)
{
    var match = Regex.Match(header, @"t=(\d+),v1=([0-9a-f]+)");
    if (!match.Success) return false;

    var timestamp = long.Parse(match.Groups[1].Value);

    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
    var expected = Convert.ToHexString(
        hmac.ComputeHash(Encoding.UTF8.GetBytes($"{timestamp}.{body}"))).ToLowerInvariant();

    // Fixed-time comparison, so the check cannot be timed.
    var signatureOk = CryptographicOperations.FixedTimeEquals(
        Encoding.UTF8.GetBytes(expected),
        Encoding.UTF8.GetBytes(match.Groups[2].Value));

    var age = Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - timestamp);
    return signatureOk && age <= 300;
}

import crypto from "node:crypto";

export function argoSignatureIsValid(body, header, secret) {
  const match = /t=(\d+),v1=([0-9a-f]+)/.exec(header);
  if (!match) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${match[1]}.${body}`)
    .digest("hex");

  // timingSafeEqual, so the comparison cannot be timed. It throws when the
  // lengths differ, which is why they are checked first.
  const signatureOk =
    expected.length === match[2].length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(match[2]));

  const age = Math.abs(Date.now() / 1000 - Number(match[1]));
  return signatureOk && age <= 300;
}

import hashlib
import hmac
import re
import time


def argo_signature_is_valid(body: str, header: str, secret: str) -> bool:
    match = re.search(r"t=(\d+),v1=([0-9a-f]+)", header)
    if not match:
        return False

    expected = hmac.new(
        secret.encode(),
        f"{match.group(1)}.{body}".encode(),
        hashlib.sha256,
    ).hexdigest()

    # compare_digest, so the comparison cannot be timed.
    if not hmac.compare_digest(expected, match.group(2)):
        return False

    return abs(time.time() - int(match.group(1))) <= 300

$url = 'https://argorobots.com/v1/events?type=revenue.imported&limit=100';

$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ab_...'],
]);

$events = json_decode(curl_exec($ch), true)['data'];
echo count($events), ' events';

using var http = new HttpClient();
http.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", "ab_...");

var page = await http.GetFromJsonAsync<JsonElement>(
    "https://argorobots.com/v1/events?type=revenue.imported&limit=100");

var events = page.GetProperty("data").GetArrayLength();
Console.WriteLine($"{events} events");

const res = await fetch(
  "https://argorobots.com/v1/events?type=revenue.imported&limit=100",
  { headers: { Authorization: "Bearer ab_..." } },
);

const { data: events } = await res.json();
console.log(`${events.length} events`);

import requests

events = requests.get(
    "https://argorobots.com/v1/events",
    params={"type": "revenue.imported", "limit": 100},
    headers={"Authorization": "Bearer ab_..."},
).json()["data"]

print(len(events), "events")