Events and event destinations

curl https://api.redbark.com/v2/event_destinations \
  -H "Authorization: Bearer rbk_live_..." \
  -H "Redbark-Version: 2026-10-01.wattle" \
  -H "Content-Type: application/json" \
  -d '{ "name": "CI", "webhook_endpoint": { "url": "https://example.com/redbark" }, "enabled_events": ["sync_run.*", "connection.*"] }'

{
  "id": "ed_5Rt7Uv9wXy1zAb3cDe5fGh",
  "object": "event_destination",
  "name": "CI",
  "type": "webhook_endpoint",
  "webhook_endpoint": { "url": "https://example.com/redbark", "signing_secret": "rbk_whsec_…" },
  "enabled_events": ["sync_run.*", "connection.*"],
  "event_payload": "thin",
  "status": "enabled",
  "status_details": null,
  "metadata": null,
  "livemode": true,
  "created": "2026-08-21T02:00:00.000Z",
  "updated": "2026-08-21T02:00:00.000Z"
}

{
  "id": "evt_2Hj4Kl6mNp8qRs0tUv2wXy",
  "object": "event",
  "type": "sync_run.succeeded",
  "created": "2026-08-21T02:00:09.000Z",
  "livemode": true,
  "reason": { "type": "request", "request": { "id": "req_6xB3V3zmWkNGSCARJFA1UE", "idempotency_key": "run-1" } },
  "related_object": { "id": "run_4Kt7Lm2nPq9rSv1wXy3zAb", "type": "sync_run", "url": "https://api.redbark.com/v2/sync_runs/run_4Kt7Lm2nPq9rSv1wXy3zAb" }
}

import { createHmac, timingSafeEqual } from 'node:crypto'

export function verifyRedbarkSignature(header: string, rawBody: string, secret: string, toleranceSeconds = 300): boolean {
  const parts = Object.fromEntries(header.split(',').map((kv) => kv.split('=') as [string, string]))
  const t = Number(parts.t)
  if (!t || Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false
  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex')
  return header
    .split(',')
    .filter((kv) => kv.startsWith('v1='))
    .some((kv) => {
      const sig = kv.slice(3)
      return sig.length === expected.length && timingSafeEqual(Buffer.from(sig), Buffer.from(expected))
    })
}