Webb9 API reference.

Send a unique Idempotency-Key header (a UUID is fine) on every POST that creates a resource, plus the quote-accept, file-attach, and webhook-replay actions. Retrying with the same key and the same request body replays the original response byte-for-byte instead of repeating the action — safe for network retries and double-clicks alike. Retrying with the same key and a different body gets a 409 idempotency_conflict. Keys are retained for 24 hours. Plain field-edit PATCH requests don't need one — they're naturally idempotent.

const crypto = require('crypto');

function verify(secret, timestamp, rawBody, signatureHeader) {
  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (age > 300) return false; // 5-minute tolerance

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');
  const provided = signatureHeader.replace(/^sha256=/, '');

  const a = Buffer.from(provided, 'utf8');
  const b = Buffer.from(expected, 'utf8');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

import hmac, hashlib, time

def verify(secret, timestamp, raw_body, signature_header):
    age = abs(time.time() - float(timestamp))
    if age > 300:  # 5-minute tolerance
        return False

    expected = hmac.new(
        secret.encode(), f"{timestamp}.{raw_body}".encode(), hashlib.sha256
    ).hexdigest()
    provided = signature_header.removeprefix("sha256=")

    return hmac.compare_digest(provided, expected)

rawBody must be the exact bytes received — verify before any JSON parsing/re-serialization touches it. A failed delivery retries with backoff (30s → 2m → 10m → 1h → 6h) and dead-letters after 5 attempts; an endpoint with no successful delivery for 3+ days is auto-disabled and its owners are notified.