Webhooks

Atlas signs every webhook payload with an HMAC of the body plus a replay window so the receiver can reject stale or replayed events. The management UI ships in a follow-up; the wire format is stable.

Event shapes

See /docs/api for every event shape. Each delivery includes the X-Atlas-Signature and X-Atlas-Timestamp headers; reject anything older than 5 minutes after parsing the body.

Verifying a signature

import crypto from "node:crypto";

function verify(body: string, sig: string, ts: string, secret: string): boolean {
  const window = Math.abs(Date.now() / 1000 - Number(ts));
  if (window > 300) return false;            // 5-minute replay window
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${ts}.${body}`)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig));
}