Webhooks

const endpoint = await story0.webhookEndpoints.create({
  url: "https://hooks.example.com/story0",
  events: ["job.succeeded", "job.failed", "job.cancelled"],
  description: "Production pipeline",
});
// Store endpoint.secret in your secret manager now: it is only returned here.

endpoint = client.webhook_endpoints.create(
    "https://hooks.example.com/story0",
    events=["job.succeeded", "job.failed", "job.cancelled"],
    description="Production pipeline",
)
# Store endpoint["secret"] in your secret manager now: it is only returned here.

curl https://api.story0.com/v1/webhook_endpoints \
  -H "Authorization: Bearer $STORY0_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://hooks.example.com/story0",
    "events": ["job.succeeded", "job.failed", "job.cancelled"],
    "description": "Production pipeline"
  }'

import express from "express";
import Story0, { WebhookVerificationError, type WebhookEvent } from "@story0/sdk";

const app = express();

// express.raw keeps the body as the exact bytes Story0 signed.
app.post("/story0", express.raw({ type: "application/json" }), async (req, res) => {
  let event: WebhookEvent;
  try {
    event = await Story0.webhooks.verify(req.body, req.headers, process.env.STORY0_WEBHOOK_SECRET!);
  } catch (err) {
    if (err instanceof WebhookVerificationError) return res.status(400).send(err.code);
    throw err;
  }
  await enqueue(event); // your own queue: do the real work outside the request
  res.sendStatus(204);
});

// app/story0/route.ts
import Story0, { type WebhookEvent } from "@story0/sdk";

export async function POST(request: Request) {
  const body = await request.text(); // the raw body, unparsed
  let event: WebhookEvent;
  try {
    event = await Story0.webhooks.verify(body, request.headers, process.env.STORY0_WEBHOOK_SECRET!);
  } catch {
    return new Response("invalid signature", { status: 400 });
  }
  await enqueue(event); // your own queue
  return new Response(null, { status: 204 });
}

import os

import story0
from fastapi import FastAPI, Request, Response

app = FastAPI()
SECRET = os.environ["STORY0_WEBHOOK_SECRET"]


@app.post("/story0")
async def story0_webhook(request: Request) -> Response:
    payload = await request.body()  # the raw bytes, unparsed
    try:
        event = story0.verify_webhook(payload, request.headers, SECRET)
    except story0.WebhookVerificationError as err:
        return Response(err.code, status_code=400)
    enqueue(event)  # your own queue
    return Response(status_code=204)

import os

import story0
from flask import Flask, request

app = Flask(__name__)
SECRET = os.environ["STORY0_WEBHOOK_SECRET"]


@app.post("/story0")
def story0_webhook():
    try:
        event = story0.verify_webhook(request.get_data(), request.headers, SECRET)
    except story0.WebhookVerificationError as err:
        return err.code, 400
    enqueue(event)  # your own queue
    return "", 204

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyStory0(rawBody: string, headers: Record<string, string | undefined>, secret: string): boolean {
  const id = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];
  const signatures = headers["webhook-signature"];
  if (!id || !timestamp || !signatures) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false; // older or newer than 5 minutes

  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const expected = Buffer.from(createHmac("sha256", key).update(`${id}.${timestamp}.${rawBody}`).digest("base64"));

  return signatures.split(" ").some((entry) => {
    const [version, signature] = entry.split(",");
    const candidate = Buffer.from(signature ?? "");
    return version === "v1" && candidate.length === expected.length && timingSafeEqual(candidate, expected);
  });
}

import base64
import hashlib
import hmac
import time


def verify_story0(raw_body: bytes, headers, secret: str) -> bool:
    msg_id = headers.get("webhook-id")
    timestamp = headers.get("webhook-timestamp")
    signatures = headers.get("webhook-signature")
    if not (msg_id and timestamp and signatures):
        return False
    if abs(time.time() - int(timestamp)) > 300:  # older or newer than 5 minutes
        return False

    key = base64.b64decode(secret.removeprefix("whsec_"))
    signed = f"{msg_id}.{timestamp}.".encode() + raw_body
    expected = base64.b64encode(hmac.new(key, signed, hashlib.sha256).digest()).decode()

    for entry in signatures.split(" "):
        version, _, signature = entry.partition(",")
        if version == "v1" and hmac.compare_digest(signature, expected):
            return True
    return False

async function handle(event: WebhookEvent) {
  if (!(await markProcessed(event.id))) return; // false when the ID was already recorded
  if (event.type !== "job.succeeded" || !event.data.job.livemode) return;

  const job = await story0.jobs.retrieve(event.data.job.id);
  if (job.result?.object === "segmentation") {
    const result = await story0.segments.retrieve(job.result.id);
    await saveTimeline(job.metadata.story_id, result.segments);
  }
}

def handle(event):
    if not mark_processed(event["id"]):  # False when the ID was already recorded
        return
    if event["type"] != "job.succeeded" or not event["data"]["job"]["livemode"]:
        return

    job = client.jobs.retrieve(event["data"]["job"]["id"])
    result_ref = job["result"]
    if result_ref and result_ref["object"] == "segmentation":
        result = client.segments.retrieve(result_ref["id"])
        save_timeline(job["metadata"].get("story_id"), result["segments"])

await story0.webhookEndpoints.test("whe_01m6gvmve09a4t7c2k6r1x8m3q");

client.webhook_endpoints.test("whe_01m6gvmve09a4t7c2k6r1x8m3q")

curl -X POST https://api.story0.com/v1/webhook_endpoints/whe_01m6gvmve09a4t7c2k6r1x8m3q/test \
  -H "Authorization: Bearer $STORY0_API_KEY"

let cursor: string | undefined;
do {
  const page = await story0.events.list({ type: "job.succeeded", limit: 100, cursor });
  for (const event of page.data) {
    if (await alreadyProcessed(event.id)) continue;
    await handleJobSucceeded(event.data.job as Job);
  }
  cursor = page.next_cursor ?? undefined;
} while (cursor);

cursor = None
while True:
    page = client.events.list(type="job.succeeded", limit=100, cursor=cursor)
    for event in page["data"]:
        if already_processed(event["id"]):
            continue
        handle_job_succeeded(event["data"]["job"])
    if not page["has_more"]:
        break
    cursor = page["next_cursor"]

curl "https://api.story0.com/v1/events?type=job.succeeded&limit=100" \
  -H "Authorization: Bearer $STORY0_API_KEY"