Monitor webhooks

import os, requests

body = {
    "name": "Petrobras coverage to webhook",
    "subject": {"type": "entity", "entity_ids": ["e_44e03bdb5422e8ca"]},
    "criteria": {"data": "events_and_stories"},
    "trigger": {"type": "new_matches"},
    "schedule": {"cadence": "daily"},
    "delivery": {"email": True, "webhook_url": "https://example.com/gdelt"},
}

r = requests.post(
    "https://gdeltcloud.com/api/v2/monitors",
    headers={"Authorization": f"Bearer {os.environ['GDELT_API_KEY']}"},
    json=body,
)
created = r.json()
monitor_id = created["monitor"]["id"]
print(monitor_id)
print(created["webhook_signing_secret"])  # returned once — store it now

const body = {
  name: "Petrobras coverage to webhook",
  subject: { type: "entity", entity_ids: ["e_44e03bdb5422e8ca"] },
  criteria: { data: "events_and_stories" },
  trigger: { type: "new_matches" },
  schedule: { cadence: "daily" },
  delivery: { email: true, webhook_url: "https://example.com/gdelt" },
};

const r = await fetch("https://gdeltcloud.com/api/v2/monitors", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.GDELT_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify(body),
});
const created = await r.json();
const monitorId = created.monitor.id;
console.log(monitorId);
console.log(created.webhook_signing_secret); // returned once — store it now

curl -X POST "https://gdeltcloud.com/api/v2/monitors" \
  -H "Authorization: Bearer $GDELT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Petrobras coverage to webhook",
    "subject": { "type": "entity", "entity_ids": ["e_44e03bdb5422e8ca"] },
    "criteria": { "data": "events_and_stories" },
    "trigger": { "type": "new_matches" },
    "schedule": { "cadence": "daily" },
    "delivery": { "email": true, "webhook_url": "https://example.com/gdelt" }
  }'

r = requests.post(
    f"https://gdeltcloud.com/api/v2/monitors/{monitor_id}/test-delivery",
    headers={"Authorization": f"Bearer {os.environ['GDELT_API_KEY']}"},
)
print(r.json()["delivery"]["delivered"], r.json()["delivery"]["status"])

const t = await fetch(
  `https://gdeltcloud.com/api/v2/monitors/${monitorId}/test-delivery`,
  { method: "POST", headers: { Authorization: `Bearer ${process.env.GDELT_API_KEY}` } },
);
const { delivery } = await t.json();
console.log(delivery.delivered, delivery.status);

curl -X POST \
  "https://gdeltcloud.com/api/v2/monitors/$MONITOR_ID/test-delivery" \
  -H "Authorization: Bearer $GDELT_API_KEY"

import crypto from "node:crypto"

// Reject a delivery whose timestamp is outside your replay window. Five minutes matches the
// tolerance this guide documents; widen it only if your receiver queues before verifying.
const TOLERANCE_MS = 5 * 60 * 1000

function validWebhook(rawBody, headers, secret, now = Date.now()) {
  const timestamp = String(headers["x-gdelt-timestamp"] ?? "")
  const received = String(headers["x-gdelt-signature"] ?? "")
  const sentAtMs = Number(timestamp) * 1000
  if (!Number.isFinite(sentAtMs) || Math.abs(now - sentAtMs) > TOLERANCE_MS) return false
  const expected = "v1=" + crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex")
  if (received.length !== expected.length) return false
  return crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected))
}

import hashlib
import hmac
import time

# Reject a delivery whose timestamp is outside your replay window.
TOLERANCE_SECONDS = 5 * 60


def valid_webhook(raw_body: bytes, headers: dict[str, str], secret: str) -> bool:
    timestamp = headers.get("x-gdelt-timestamp", "")
    received = headers.get("x-gdelt-signature", "")
    try:
        if abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
            return False
    except ValueError:
        return False
    signed = timestamp.encode() + b"." + raw_body
    expected = "v1=" + hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(received, expected)

r = requests.patch(
    f"https://gdeltcloud.com/api/v2/monitors/{monitor_id}",
    headers={"Authorization": f"Bearer {os.environ['GDELT_API_KEY']}"},
    json={"rotate_webhook_secret": True},
)
print(r.json()["webhook_signing_secret"])  # the only time you will see it

const r = await fetch(`https://gdeltcloud.com/api/v2/monitors/${monitorId}`, {
  method: "PATCH",
  headers: {
    Authorization: `Bearer ${process.env.GDELT_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ rotate_webhook_secret: true }),
});
console.log((await r.json()).webhook_signing_secret); // the only time you will see it

curl -X PATCH "https://gdeltcloud.com/api/v2/monitors/$MONITOR_ID" \
  -H "Authorization: Bearer $GDELT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"rotate_webhook_secret":true}'