Webhooks

This tool finishes after its response, so the result is delivered to the webhook URL registered on the key that started the run. Nothing needs to be polled.

Webhooks

Event	Description
`doc_tampering.completed`	The check finished. `data` carries the score and the routing outcome.
`doc_tampering.failed`	The check couldn't be completed. Nothing is charged. `trust_score` and `route` are null.

Header	Description
`X-Kriyam-Signature`	`t=<unix>,v1=<hex>` — an HMAC-SHA256 of `"{timestamp}.{body}"` using the endpoint's signing secret. The timestamp is inside the signed string, so a captured body can't be replayed.

Verify a delivery

import hashlib, hmac

# Hash the raw request body, never a re-serialised copy of it.
t, v1 = (p.split('=', 1)[1] for p in request.headers['X-Kriyam-Signature'].split(','))
expected = hmac.new(SECRET.encode(), f'{t}.'.encode() + raw_body, hashlib.sha256).hexdigest()
assert hmac.compare_digest(expected, v1)

Set a webhook URL on your key →