Eventi InTransparency in qualunque strumento

Shell

# The key needs the agent:webhook scope (agent:write covers it too).
# Tick "Webhooks" when you create it at /developers/keys.
curl -X POST https://www.in-transparency.com/api/agents/webhooks \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://hooks.zapier.com/hooks/catch/123456/abcdef/",
    "events": ["match.created"]
  }'

# Response. The secret is shown exactly once, so store it now:
# {
#   "id": "cmh4p2x7k0002s8v3",
#   "url": "https://hooks.zapier.com/hooks/catch/123456/abcdef/",
#   "events": ["match.created"],
#   "active": true,
#   "createdAt": "2026-05-03T14:20:51.000Z",
#   "secret": "3f8a…64 hex characters…c1",
#   "message": "Store the secret — we use HMAC-SHA256 to sign every delivery…"
# }

HTTP

POST <your-url>
Content-Type: application/json
User-Agent: InTransparency-Webhook/1.0
X-InTransparency-Signature: sha256=<hex HMAC-SHA256 of the raw body>
X-InTransparency-Delivery: <delivery id>

{
  "event": "match.created",
  "eventId": "cmh3x9q2a0001k7w4",
  "occurredAt": "2026-05-03T14:22:08.000Z",
  "data": {
    "matchId": "cmh3x9q2a0001k7w4",
    "candidateId": "cmh1k7w4n0007p2r9",
    "candidatePseudonym": "stu_4f2a91c0b6e54d12",
    "candidateName": "Giulia M.",
    "matchScore": 89,
    "decisionLabel": "STRONG_MATCH",
    "jobId": "cmh2b8r1v0003x5q1",
    "url": "https://www.in-transparency.com/en/matches/cmh3x9q2a0001k7w4/why"
  }
}

Node.js

// Node.js — check the signature before trusting the payload.
// rawBody is the body exactly as it arrived (a Buffer or a string):
// parsing and re-serialising it changes the bytes, and the HMAC with them.
import crypto from 'crypto'

function isValid(rawBody, signatureHeader, secret) {
  const expected = 'sha256=' +
    crypto.createHmac('sha256', secret).update(rawBody).digest('hex')
  const received = Buffer.from(signatureHeader || '')
  // timingSafeEqual throws when the lengths differ, so compare them first.
  return received.length === expected.length &&
    crypto.timingSafeEqual(received, Buffer.from(expected))
}