Webhooks

{  "event_id":   "01H9X3K2Y5MQXW8...",  "event_type": "watchlist.match",  "occurred_at": "2026-05-28T10:14:32Z",  "tenant_id":  "01H8...",  "watchlist": {    "id":     "01H9...",    "name":   "out-of-state owners, high equity"  },  "match": {    "folio":         "30-3122-008-0440",    "address":       "4567 NW 22nd Av, Miami FL 33125",    "score":         0.78,    "signals_fired": ["out_of_state_owner", "tenure_years_long",                     "no_homestead", "code_violation"],    "owner": {      "name":          "SUNNY HOLDINGS LLC",      "mailing_state": "NY"    },    "valuation": { "just_value": 412000, "est_equity": 298000 },    "observed_at": "2026-05-28T10:14:00Z"  }}

import hmacimport hashlibimport time from flask import Flask, request, abort WEBHOOK_SECRET = b"whsec_..."   # from terminal.house dashboardTOLERANCE_SECONDS = 300         # reject signatures older than 5 min app = Flask(__name__)  def _parse_signature_header(header: str) -> tuple[int, str]:    """Parse 'X-FLPF-Signature: t=<ts>,v1=<hex>' into (timestamp, hex)."""    parts = dict(p.split("=", 1) for p in header.split(","))    return int(parts["t"]), parts["v1"]  @app.post("/webhook")def receive():    sig_header = request.headers.get("X-FLPF-Signature", "")    if not sig_header:        abort(400, "missing signature")     timestamp, supplied_sig = _parse_signature_header(sig_header)    if abs(time.time() - timestamp) > TOLERANCE_SECONDS:        abort(400, "stale signature")     msg = f"{timestamp}.{request.get_data(as_text=True)}".encode()    expected = hmac.new(WEBHOOK_SECRET, msg, hashlib.sha256).hexdigest()    if not hmac.compare_digest(expected, supplied_sig):        abort(401, "invalid signature")     delivery_id = request.headers["X-FLPF-Webhook-Id"]    # ...dedupe on delivery_id, then do useful work...    return "", 200

import express from "express";import crypto from "node:crypto"; const WEBHOOK_SECRET = Buffer.from(process.env.WEBHOOK_SECRET!, "utf8");const TOLERANCE_SECONDS = 300; const app = express(); // Important: use the raw body for HMAC. JSON-parsing first would// re-serialize and break the signature.app.post(  "/webhook",  express.raw({ type: "application/json" }),  (req, res) => {    const sigHeader = req.header("x-flpf-signature") ?? "";    if (!sigHeader) return res.status(400).send("missing signature");     const parts = Object.fromEntries(      sigHeader.split(",").map((p) => p.split("=", 2) as [string, string]),    );    const timestamp = parseInt(parts.t, 10);    const supplied = parts.v1;     if (Math.abs(Date.now() / 1000 - timestamp) > TOLERANCE_SECONDS) {      return res.status(400).send("stale signature");    }     const msg = Buffer.concat([      Buffer.from(`${timestamp}.`, "utf8"),      req.body as Buffer,    ]);    const expected = crypto      .createHmac("sha256", WEBHOOK_SECRET)      .update(msg)      .digest("hex");     const expectedBuf = Buffer.from(expected, "hex");    const suppliedBuf = Buffer.from(supplied, "hex");    if (      expectedBuf.length !== suppliedBuf.length ||      !crypto.timingSafeEqual(expectedBuf, suppliedBuf)    ) {      return res.status(401).send("invalid signature");    }     const deliveryId = req.header("x-flpf-webhook-id")!;    // ...dedupe on deliveryId, then do useful work...    res.status(200).send();  },); app.listen(3000);