PDF jobs and webhooks

curl https://api.96astro.com/v1/jobs/pdf \
  -H "Authorization: Bearer $ASTRO_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 7b1e4c52-0f3a-4d8e-9c61-5a2f8e3d9b10" \
  -d '{
    "capability": "report-career",
    "input": {
      "datetime": "1990-10-18T14:30:00",
      "timezone": "Asia/Kolkata",
      "latitude": 28.6139,
      "longitude": 77.209
    },
    "branding": { "brand_name": "Shree Jyotish Kendra", "accent": "#1f4fd1" }
  }'

{
  "data": {
    "id": "2c863278-518b-407e-8234-0ba0f824404c",
    "object": "job",
    "kind": "pdf",
    "capability": "report-career",
    "status": "queued",
    "attempts": 0,
    "credits": 130,
    "created_at": "2026-10-14T06:58:59.069427Z",
    "started_at": null,
    "finished_at": null,
    "error": null,
    "download_url": null,
    "download_expires_at": null,
    "file_expires_at": null
  },
  "meta": {
    "request_id": "req_84c3f093ee178943738c",
    "api_version": "v1",
    "credits_reserved": 130,
    "warnings": []
  }
}

POST /webhooks/96astro HTTP/1.1
Content-Type: application/json
User-Agent: 96Astro-Webhooks/1
Astro-Webhook-Id: evt_5f0c1e2a7b3d4c6e8f9a0b1c2d3e4f50
Astro-Webhook-Timestamp: 1760425200
Astro-Signature: v1=6f1c0c3d6b0e4c7a2d9e8f1b3a5c7d9e0f2a4b6c8d0e1f3a5b7c9d1e3f5a7b9c

{
  "id": "evt_5f0c1e2a7b3d4c6e8f9a0b1c2d3e4f50",
  "type": "job.succeeded",
  "created": 1760425200,
  "environment": "live",
  "project_id": "8d7f2b1e-4c3a-4e5f-9a1b-2c3d4e5f6a7b",
  "data": {
    "id": "2c863278-518b-407e-8234-0ba0f824404c",
    "object": "job",
    "kind": "pdf",
    "capability": "report-career",
    "status": "succeeded",
    "attempts": 1,
    "credits": 130,
    "created_at": "2026-10-14T06:58:59.069427Z",
    "started_at": "2026-10-14T06:59:01.112040Z",
    "finished_at": "2026-10-14T06:59:09.874120Z",
    "error": null,
    "download_url": "https://api.96astro.com/v1/files/…",
    "download_expires_at": "2026-10-15T08:00:00Z",
    "file_expires_at": "2026-10-21T06:59:09.874120Z"
  }
}

import crypto from "node:crypto";
import express from "express";

const SECRETS = [process.env.ASTRO_WEBHOOK_SECRET]; // add the new secret here while you rotate
const TOLERANCE_SECONDS = 300;

function verify(rawBody, headers) {
  const id = headers["astro-webhook-id"];
  const timestamp = headers["astro-webhook-timestamp"];
  const signature = headers["astro-signature"];
  if (!id || !/^\d+$/.test(timestamp ?? "") || !signature) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > TOLERANCE_SECONDS) return false;
  const signed = Buffer.concat([Buffer.from(`${id}.${timestamp}.`), rawBody]);
  const received = signature
    .split(",")
    .map((part) => part.trim())
    .filter((part) => part.startsWith("v1="))
    .map((part) => Buffer.from(part.slice(3), "hex"));
  return SECRETS.some((secret) => {
    const expected = crypto.createHmac("sha256", secret).update(signed).digest();
    return received.some((sig) => sig.length === expected.length && crypto.timingSafeEqual(sig, expected));
  });
}

const app = express();
app.post("/webhooks/96astro", express.raw({ type: "application/json" }), (req, res) => {
  if (!verify(req.body, req.headers)) return res.status(400).send("bad signature");
  const event = JSON.parse(req.body.toString("utf8"));
  // Deduplicate on event.id, queue the work, then answer quickly.
  res.sendStatus(204);
});
app.listen(3000);

import hashlib
import hmac
import os
import time

SECRETS = [os.environ["ASTRO_WEBHOOK_SECRET"]]  # add the new secret here while you rotate
TOLERANCE_SECONDS = 300


def verify(raw_body: bytes, headers) -> bool:
    event_id = headers.get("Astro-Webhook-Id")
    timestamp = headers.get("Astro-Webhook-Timestamp", "")
    signature = headers.get("Astro-Signature", "")
    if not event_id or not timestamp.isdigit() or not signature:
        return False
    if abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
        return False
    signed = f"{event_id}.{timestamp}.".encode() + raw_body
    received = [part.strip()[3:] for part in signature.split(",") if part.strip().startswith("v1=")]
    for secret in SECRETS:
        expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
        if any(hmac.compare_digest(expected, sig) for sig in received):
            return True
    return False

SECRET='whsec_...'           # your sandbox endpoint's secret
ID="evt_local_$(date +%s)"
TS=$(date +%s)               # must be within 5 minutes of your server's clock
BODY='{"id":"'"$ID"'","type":"webhook.test","created":'"$TS"',"environment":"test","data":{"message":"hello"}}'
SIG=$(printf '%s' "$ID.$TS.$BODY" | openssl dgst -sha256 -hmac "$SECRET" -hex | sed 's/^.* //')

curl -i http://localhost:3000/webhooks/96astro \
  -H "Content-Type: application/json" \
  -H "Astro-Webhook-Id: $ID" \
  -H "Astro-Webhook-Timestamp: $TS" \
  -H "Astro-Signature: v1=$SIG" \
  --data-raw "$BODY"