الانتقال إلى المحتوى الرئيسي

POST /audit-source/:id/event

Inbound webhook receiver. Pipes any JSON body into the entangled state.

Method POST Path /api/zeq/audit-source/:id/event Auth Optional HMAC (X-Zeq-Signature) Group Audit Source

Headers​

HeaderRequiredNotes
Content-Type: application/jsonyesonly JSON bodies are stamped
X-Zeq-Signature: sha256=<hex>conditionalrequired when source_config.secret is set
X-Delivery-Id: <opaque>nodedupe / replay token; auto-minted if absent

Body​

Any JSON. The adapter sha256s the canonical form and records that as document_hash. There is no schema — push whatever shape your upstream emits.

Response​

{ "ok": true, "delivery_id": "<token>" }

Errors:

  • 401 signature_required — secret is configured but no header
  • 401 signature_mismatch — HMAC didn't match the body
  • 503 adapter_not_running — the agent was killed or has not yet boot-restored

Sign your payload (when secret is set)​

import crypto from "node:crypto";
const sig = "sha256=" + crypto
  .createHmac("sha256", process.env.AUDIT_SECRET)
  .update(JSON.stringify(body))
  .digest("hex");

await fetch(`${ZEQ_DEV}/api/zeq/audit-source/${agentId}/event`, {
  method: "POST",
  headers: { "Content-Type": "application/json", "X-Zeq-Signature": sig },
  body: JSON.stringify(body),
});

Reference​

  • Source: shared/api-core/src/lib/dataSourceAudit/sources/httpWebhook.ts
  • Stamper: shared/api-core/src/lib/dataSourceAudit/stamper.ts

Universal POST intake. Phase-locked at 1.287 Hz.