const response = await fetch('https://regpilot.dev/api/webhooks', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.REGPILOT_API_KEY!,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    url: 'https://your-app.com/webhooks/regpilot',
    events: ['alert.created', 'case.created', 'violation.detected'],
    secret: 'your_webhook_secret' // For signature verification
  })
});

{
  id: string,              // Event ID
  type: string,           // Event type (e.g., 'alert.created')
  timestamp: string,      // ISO 8601 timestamp
  project_id: string,     // Project ID
  data: {
    // Event-specific data
  }
}

{
  "id": "evt_abc123",
  "type": "alert.created",
  "timestamp": "2025-11-17T12:00:00Z",
  "project_id": "proj_xyz789",
  "data": {
    "alert_id": "alert_123",
    "severity": "HIGH",
    "title": "High risk content detected",
    "message": "AI response had risk score of 85"
  }
}

{
  "id": "evt_def456",
  "type": "violation.detected",
  "timestamp": "2025-11-17T12:00:00Z",
  "project_id": "proj_xyz789",
  "data": {
    "violation_id": "viol_456",
    "type": "PRIVACY",
    "severity": "CRITICAL",
    "description": "PII detected in response"
  }
}

// app/api/webhooks/regpilot/route.ts (Next.js)
export async function POST(request: Request) {
  const payload = await request.json();
  
  // Verify signature (recommended)
  const signature = request.headers.get('x-regpilot-signature');
  if (!verifySignature(payload, signature)) {
    return Response.json({ error: 'Invalid signature' }, { status: 401 });
  }
  
  // Handle event
  switch (payload.type) {
    case 'alert.created':
      await handleAlertCreated(payload.data);
      break;
    
    case 'violation.detected':
      await handleViolationDetected(payload.data);
      break;
    
    default:
      console.log('Unhandled event:', payload.type);
  }
  
  return Response.json({ received: true });
}

app.post('/webhooks/regpilot', express.json(), async (req, res) => {
  const payload = req.body;
  
  // Verify signature
  const signature = req.headers['x-regpilot-signature'];
  if (!verifySignature(payload, signature)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  
  // Handle event
  try {
    switch (payload.type) {
      case 'alert.created':
        await handleAlert(payload.data);
        break;
      
      case 'case.created':
        await handleCase(payload.data);
        break;
    }
    
    res.json({ received: true });
  } catch (error) {
    console.error('Webhook error:', error);
    res.status(500).json({ error: 'Processing failed' });
  }
});

import crypto from 'crypto';

function verifySignature(payload: any, signature: string | null): boolean {
  if (!signature) return false;
  
  const secret = process.env.WEBHOOK_SECRET!;
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(payload))
    .digest('hex');
  
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

if (!verifySignature(payload, signature)) {
  return Response.json({ error: 'Unauthorized' }, { status: 401 });
}

export async function POST(request: Request) {
  const payload = await request.json();
  
  // Queue for async processing
  await queue.add(payload);
  
  // Respond immediately
  return Response.json({ received: true });
}

const processedEvents = new Set<string>();

async function handleWebhook(payload: any) {
  if (processedEvents.has(payload.id)) {
    return; // Already processed
  }
  
  // Process event
  await processEvent(payload);
  
  processedEvents.add(payload.id);
}

# Start ngrok
ngrok http 3000

# Use ngrok URL for webhook
# https://abc123.ngrok.io/webhooks/regpilot

// Trigger test webhook
await fetch('https://regpilot.dev/api/webhooks/test', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.REGPILOT_API_KEY!,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    webhook_id: 'webhook_123',
    event_type: 'alert.created'
  })
});

GET https://regpilot.dev/api/webhooks

PATCH https://regpilot.dev/api/webhooks/{webhook_id}

DELETE https://regpilot.dev/api/webhooks/{webhook_id}