HALOWERKSicherwerk
webhook signature
Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a mismatch that looks exactly like an attack. This checks the signature the way the named provider actually specifies, with constant-time comparison, and returns the string that was signed so a mismatch can be debugged instead of guessed at.
POST https://sicher.halowerk.com/v1/webhook-signatureEingaben
| Feld | Typ | Pflicht | Beschreibung |
|---|---|---|---|
| provider | string | Ja | Which provider signed the request. |
| body | string | Ja | The raw request body exactly as received, not re-serialised. |
| secret | string | Ja | The signing secret. |
| signature | string | Nein | The signature header value. Required unless headers is given. |
| headers | object | Nein | All request headers; the right one is picked by provider. |
| timestamp | string | Nein | Timestamp, if the provider signs one and it is not in the headers. |
| message_id | string | Nein | Message id for schemes that sign one, e.g. Svix. |
| tolerance_seconds | integer | Nein | How old a signed timestamp may be. |
Vollständiges Eingabeschema anzeigen
{
"type": "object",
"required": [
"provider",
"body",
"secret"
],
"additionalProperties": false,
"properties": {
"provider": {
"type": "string",
"enum": [
"github",
"stripe",
"shopify",
"slack",
"svix",
"generic_hmac"
],
"description": "Which provider signed the request."
},
"body": {
"type": "string",
"maxLength": 200000,
"description": "The raw request body exactly as received, not re-serialised."
},
"secret": {
"type": "string",
"minLength": 1,
"maxLength": 2000,
"description": "The signing secret."
},
"signature": {
"type": "string",
"maxLength": 2000,
"description": "The signature header value. Required unless headers is given."
},
"headers": {
"type": "object",
"description": "All request headers; the right one is picked by provider."
},
"timestamp": {
"type": "string",
"maxLength": 40,
"description": "Timestamp, if the provider signs one and it is not in the headers."
},
"message_id": {
"type": "string",
"maxLength": 200,
"description": "Message id for schemes that sign one, e.g. Svix."
},
"tolerance_seconds": {
"type": "integer",
"minimum": 1,
"maximum": 86400,
"default": 300,
"description": "How old a signed timestamp may be."
}
}
}Veröffentlichtes Eingabebeispiel
{
"provider": "github",
"body": "{\"synthetic\":true,\"event\":\"documentation-example\"}",
"secret": "HALOWERK-public-synthetic-example-never-use-for-authentication",
"signature": "sha256=fdfaa7380ce9e369a7d90e8651603bb777a4f008dd3070b056d2b59122d602f8"
}Ergebnis & Dokumentation
Veröffentlichtes Ergebnisschema anzeigen
{
"$ref": "https://sicher.halowerk.com/v1/webhook-signature/schema#/outputSchema"
}Veröffentlichtes Ergebnisbeispiel öffnen
Maschinenlesbare Dokumentation dieses Hubs
Quelle dieser Seite: der veröffentlichte HALOWERK-Katalog. Stand: 2026-11-01, 15:19 UTC.
Weitere Endpunkte dieses Hubs
- Sicherwerk0,005 USDC
container inspect
POSThttps://sicher.halowerk.com/v1/container-inspectReads the manifest and config of an OCI or Docker image straight from the registry — a few kilobytes, never the layers, and the image is never run. Returns the digest, the platforms a multi-arch index covers, every layer with its size and t
- Sicherwerk0,005 USDC
cve check
POSThttps://sicher.halowerk.com/v1/cve-checkQueries OSV.dev for a list of packages with versions across npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist and the Linux distributions. For each package it returns the vulnerabilities found with their identifiers, severity and
- Sicherwerk0,005 USDC
hash reputation
POSThttps://sicher.halowerk.com/v1/hash-reputationQueries three abuse.ch metadata services for an MD5, SHA-1 or SHA-256 value. It reports known malware metadata, associated ThreatFox indicators, and URLhaus payload provenance, then derives a conservative known-malicious or unknown verdict.