{
  "x402Version": 2,
  "id": 55189,
  "slug": "55189",
  "resource": "https://sicher.halowerk.com/v1/webhook-signature",
  "description": "Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a mismatch that looks exactly like an attack. This checks the signature the way the named provider actually specifies, with constant-time comparison, and returns the string that was signed so a mismatch can be debugged instead of guessed at.",
  "type": "http",
  "resourceType": "Utilities",
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:8453",
      "payTo": "0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E",
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "amount": "2000",
      "amountUsd": 0.002,
      "maxTimeoutSeconds": 300
    }
  ],
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "body": {
            "body": "{\"synthetic\":true,\"event\":\"documentation-example\"}",
            "provider": "github",
            "secret": "HALOWERK-public-synthetic-example-never-use-for-authentication",
            "signature": "sha256=fdfaa7380ce9e369a7d90e8651603bb777a4f008dd3070b056d2b59122d602f8"
          },
          "bodyType": "json",
          "method": "POST",
          "type": "http"
        }
      },
      "schema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "input": {
            "additionalProperties": false,
            "properties": {
              "body": {
                "additionalProperties": false,
                "properties": {
                  "body": {
                    "description": "The raw request body exactly as received, not re-serialised.",
                    "maxLength": 200000,
                    "type": "string"
                  },
                  "headers": {
                    "description": "All request headers; the right one is picked by provider.",
                    "type": "object"
                  },
                  "message_id": {
                    "description": "Message id for schemes that sign one, e.g. Svix.",
                    "maxLength": 200,
                    "type": "string"
                  },
                  "provider": {
                    "description": "Which provider signed the request.",
                    "enum": [
                      "github",
                      "stripe",
                      "shopify",
                      "slack",
                      "svix",
                      "generic_hmac"
                    ],
                    "type": "string"
                  },
                  "secret": {
                    "description": "The signing secret.",
                    "maxLength": 2000,
                    "minLength": 1,
                    "type": "string"
                  },
                  "signature": {
                    "description": "The signature header value. Required unless headers is given.",
                    "maxLength": 2000,
                    "type": "string"
                  },
                  "timestamp": {
                    "description": "Timestamp, if the provider signs one and it is not in the headers.",
                    "maxLength": 40,
                    "type": "string"
                  },
                  "tolerance_seconds": {
                    "default": 300,
                    "description": "How old a signed timestamp may be.",
                    "maximum": 86400,
                    "minimum": 1,
                    "type": "integer"
                  }
                },
                "required": [
                  "provider",
                  "body",
                  "secret"
                ],
                "type": "object"
              },
              "bodyType": {
                "enum": [
                  "json",
                  "form-data",
                  "text"
                ],
                "type": "string"
              },
              "method": {
                "enum": [
                  "POST",
                  "PUT",
                  "PATCH"
                ],
                "type": "string"
              },
              "type": {
                "const": "http",
                "type": "string"
              }
            },
            "required": [
              "type",
              "method",
              "bodyType",
              "body"
            ],
            "type": "object"
          }
        },
        "required": [
          "input"
        ],
        "type": "object"
      }
    }
  },
  "tags": [
    "bazaar"
  ],
  "sourceHost": "sicher.halowerk.com",
  "lastUpdated": "2026-10-08T05:40:41.664Z",
  "quality": {
    "calls30d": 4,
    "uniquePayers30d": 4,
    "lastCalledAt": "2026-10-08T05:40:41.242Z"
  },
  "metadata": {
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "body": {
              "body": "{\"synthetic\":true,\"event\":\"documentation-example\"}",
              "provider": "github",
              "secret": "HALOWERK-public-synthetic-example-never-use-for-authentication",
              "signature": "sha256=fdfaa7380ce9e369a7d90e8651603bb777a4f008dd3070b056d2b59122d602f8"
            },
            "bodyType": "json",
            "method": "POST",
            "type": "http"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "body": {
                  "additionalProperties": false,
                  "properties": {
                    "body": {
                      "description": "The raw request body exactly as received, not re-serialised.",
                      "maxLength": 200000,
                      "type": "string"
                    },
                    "headers": {
                      "description": "All request headers; the right one is picked by provider.",
                      "type": "object"
                    },
                    "message_id": {
                      "description": "Message id for schemes that sign one, e.g. Svix.",
                      "maxLength": 200,
                      "type": "string"
                    },
                    "provider": {
                      "description": "Which provider signed the request.",
                      "enum": [
                        "github",
                        "stripe",
                        "shopify",
                        "slack",
                        "svix",
                        "generic_hmac"
                      ],
                      "type": "string"
                    },
                    "secret": {
                      "description": "The signing secret.",
                      "maxLength": 2000,
                      "minLength": 1,
                      "type": "string"
                    },
                    "signature": {
                      "description": "The signature header value. Required unless headers is given.",
                      "maxLength": 2000,
                      "type": "string"
                    },
                    "timestamp": {
                      "description": "Timestamp, if the provider signs one and it is not in the headers.",
                      "maxLength": 40,
                      "type": "string"
                    },
                    "tolerance_seconds": {
                      "default": 300,
                      "description": "How old a signed timestamp may be.",
                      "maximum": 86400,
                      "minimum": 1,
                      "type": "integer"
                    }
                  },
                  "required": [
                    "provider",
                    "body",
                    "secret"
                  ],
                  "type": "object"
                },
                "bodyType": {
                  "enum": [
                    "json",
                    "form-data",
                    "text"
                  ],
                  "type": "string"
                },
                "method": {
                  "enum": [
                    "POST",
                    "PUT",
                    "PATCH"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method",
                "bodyType",
                "body"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    }
  },
  "liveness": {
    "reliability": null
  },
  "verified": false,
  "featured": false,
  "provider": {
    "host": "sicher.halowerk.com",
    "manifest_name": "sicher.halowerk.com",
    "source": "cdp-mirror",
    "source_manifest_url": "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources",
    "submitted_at": "2026-10-14T01:15:01.050Z"
  }
}