Webhook Setup

curl -X POST https://api.disclosedcapitol.com/alerts/subscriptions \
  -H "DC-API-Key: <your-pro-key>" \
  -H "Content-Type: application/json" \
  -d '{
    "alert_type":     "trade.created",
    "delivery":       "webhook",
    "webhook_url":    "https://your-server.com/hook",
    "webhook_secret": "a-strong-secret-you-choose",
    "filter_value":   "NVDA"
  }'

# → { "id": 12, "status": "created" }

curl -X POST https://api.disclosedcapitol.com/alerts/subscriptions/12/test \
  -H "DC-API-Key: <your-pro-key>"

# → { "delivered": true, "event": "trade.created", "test": true }

import hmac, hashlib

def verify(raw_body: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

const crypto = require("crypto");

function verify(rawBody, signature, secret) {
  const expected = crypto.createHmac("sha256", secret)
    .update(rawBody).digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected), Buffer.from(signature));
}

import hmac, hashlib
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = "a-strong-secret-you-choose"
seen = set()  # use a real store in production

@app.post("/hook")
def hook():
    raw = request.get_data()  # raw bytes — verify BEFORE parsing
    sig = request.headers.get("X-DisclosedCapitol-Signature", "")
    expected = hmac.new(SECRET.encode(), raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, sig):
        abort(401)

    evt = request.get_json()
    key = (evt["event"], evt["data"]["id"])
    if key in seen:
        return "", 200        # duplicate — ack & ignore
    seen.add(key)

    handle(evt["event"], evt["data"])  # your logic
    return "", 200            # ack fast; do slow work async