Webhooks

curl --request POST \
  --url https://api.parallel.ai/v1beta/tasks/runs \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: YOUR_API_KEY' \
  --data '{
    "task_spec": {
      "output_schema": "Find the GDP of the specified country and year"
    },
    "input": "France (2023)",
    "processor": "core",
    "metadata": {
      "key": "value"
    },
    "webhook": {
      "url": "https://your-domain.com/webhooks/parallel",
      "event_types": ["task_run.status"],
      "secret": "your-optional-custom-secret"
    }
  }'

import base64
import hashlib
import hmac

def verify_webhook_signature(
    body: bytes,
    secret: str,
    header_signature: str,
    webhook_id: str,
    webhook_timestamp: str,
) -> bool:
    """Verify a webhook signature.

    Args:
        body: The raw request body bytes
        secret: The webhook secret key
        header_signature: The signature from the webhook-signature header
        webhook_id: The webhook ID from the webhook-id header
        webhook_timestamp: The timestamp from the webhook-timestamp header

    Returns:
        True if signature is valid, False otherwise
    """
    # Create the payload string: webhook_id.timestamp.body
    payload = f"{webhook_id}.{webhook_timestamp}.{body.decode()}"

    # Compute HMAC-SHA256 signature
    computed_signature = hmac.new(
        secret.encode(),
        payload.encode(),
        hashlib.sha256
    ).digest()

    # Convert to base64url format (URL-safe base64 without padding)
    digest_b64_urlsafe = base64.urlsafe_b64encode(computed_signature).decode().rstrip("=")

    # Compare signatures using constant-time comparison
    return hmac.compare_digest(digest_b64_urlsafe, header_signature)

# Example usage with multiple signatures
def verify_webhook_signatures(
    body: bytes,
    secret: str,
    webhook_signature: str,
    webhook_id: str,
    webhook_timestamp: str,
) -> bool:
    """Verify webhook signatures, handling multiple signatures in header.

    Args:
        body: The raw request body bytes
        secret: The webhook secret key
        webhook_signature: The webhook-signature header value
        webhook_id: The webhook ID from the webhook-id header
        webhook_timestamp: The timestamp from the webhook-timestamp header

    Returns:
        True if any signature is valid, False otherwise
    """
    # Extract signature from header (remove "v1," prefix if present)
    header_signatures = [
        signature.split(",", 1)[-1] for signature in webhook_signature.split()
    ]

    signature_valid = any(
        verify_webhook_signature(
            body,
            secret,
            header_signature,
            webhook_id,
            webhook_timestamp,
        )
        for header_signature in header_signatures
    )

    return signature_valid

# Usage example
webhook_id = "whevent_2KWPBgLlAfxdpx2AI54pPJ85f4W"
webhook_timestamp = "1674087231"
body = b'{"type":"task_run.status","timestamp":"2022-11-03T20:26:10.344522Z","data":{"run_id":"trun_123"}}'
secret = "your-secret-key"
header_sig = "v1,K5oZfzN95Z9UVu1EsfQmfVNQhnkZ2pj9o9NDN/H/pI4="

if verify_webhook_signatures(body, secret, header_sig, webhook_id, webhook_timestamp):
    print("✅ Signature verification successful")
else:
    print("❌ Signature verification failed")