{
  "runId": "run_abc123",
  "agentId": "agent_xyz",
  "agentName": "Customer Support Bot",
  "input": "Help me reset my password"
}

{
  "runId": "run_abc123",
  "agentId": "agent_xyz",
  "agentName": "Customer Support Bot",
  "input": "Help me reset my password",
  "output": "I can help you reset your password...",
  "totalSteps": 3,
  "durationMs": 4500,
  "unitsUsed": 1,
  "unitType": "agent_runs"
}

{
  "runId": "run_abc123",
  "agentId": "agent_xyz",
  "agentName": "Customer Support Bot",
  "input": "Help me reset my password",
  "errorMessage": "Rate limit exceeded"
}

{
  "jobId": "job_abc123",
  "tool": "video",
  "model": "fal-ai/minimax/video-01"
}

{
  "jobId": "job_abc123",
  "tool": "video",
  "model": "fal-ai/minimax/video-01",
  "outputUrl": "https://fal.media/files/video.mp4",
  "durationMs": 45000,
  "unitsUsed": 5,
  "unitType": "video_seconds"
}

{
  "jobId": "job_abc123",
  "tool": "video",
  "model": "fal-ai/minimax/video-01",
  "errorMessage": "Content policy violation"
}

{
  "bucketType": "chat_tokens",
  "remaining": 8500,
  "limit": 100000,
  "percentUsed": 91.5
}

{
  "subscriptionId": "sub_abc123",
  "planCode": "pro_monthly",
  "planName": "Pro Monthly",
  "status": "active"
}

import crypto from 'crypto';

function verifyWebhookSignature(
  payload: string,
  signature: string,
  timestamp: string,
  secret: string
): boolean {
  const signedPayload = `${timestamp}:${payload}`;
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

// Express.js example
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-novakit-signature'] as string;
  const timestamp = req.headers['x-novakit-timestamp'] as string;
  const payload = req.body.toString();

  if (!verifyWebhookSignature(payload, signature, timestamp, WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = JSON.parse(payload);
  // Process event...

  res.status(200).json({ received: true });
});

import hmac
import hashlib
from flask import Flask, request, jsonify

def verify_webhook_signature(payload: bytes, signature: str, timestamp: str, secret: str) -> bool:
    signed_payload = f"{timestamp}:{payload.decode()}"
    expected = hmac.new(
        secret.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def webhook():
    signature = request.headers.get('x-novakit-signature')
    timestamp = request.headers.get('x-novakit-timestamp')
    payload = request.get_data()

    if not verify_webhook_signature(payload, signature, timestamp, WEBHOOK_SECRET):
        return jsonify({'error': 'Invalid signature'}), 401

    event = request.get_json()
    # Process event...

    return jsonify({'received': True}), 200

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "io"
    "net/http"
)

func verifySignature(payload, signature, timestamp, secret string) bool {
    signedPayload := fmt.Sprintf("%s:%s", timestamp, payload)
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(signedPayload))
    expected := hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(signature), []byte(expected))
}

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    signature := r.Header.Get("x-novakit-signature")
    timestamp := r.Header.Get("x-novakit-timestamp")
    payload, _ := io.ReadAll(r.Body)

    if !verifySignature(string(payload), signature, timestamp, webhookSecret) {
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }

    // Process event...
    w.WriteHeader(http.StatusOK)
}