Webhooks

{
  "event_type": "payment.escalated",
  "timestamp": "2026-03-28T22:51:18.715Z",
  "data": {
    "request_id": "uuid",
    "agent_id": "uuid",
    "agent_name": "Payment Bot",
    "action_key": "payments.release",
    "amount": 6200,
    "vendor": "TechVendor Inc",
    "decision": "ESCALATE",
    "reason": "Approval required by policy",
    "matched_policy": "Escalate large payments",
    "risk_score": 51,
    "timestamp": "2026-03-28T22:51:17.670Z"
  }
}

const crypto = require('crypto')

function verifyWebhook(payload, signature, secret) {
  const expected = 'sha256=' + 
    crypto
      .createHmac('sha256', secret)
      .update(payload)
      .digest('hex')
  
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  )
}

// In your webhook handler:
const signature = req.headers['x-layer3x-signature']
const isValid = verifyWebhook(
  JSON.stringify(req.body), 
  signature, 
  YOUR_WEBHOOK_SECRET
)

if (!isValid) {
  return res.status(401).send('Invalid signature')
}