Webhooks

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(expectedSignature),
    Buffer.from(signature)
  );
}

{
  "event_id": "a0b1c2d3-e4f5-6789-abcd-ef0123456789",
  "event_type": "scan.started",
  "timestamp": "2025-01-15T15:40:00.000Z",
  "data": {
    "company": "comp-uuid-1234",
    "scan_id": "scan-uuid-7890",
    "run_id": "run-12345",
    "project": {
      "id": "proj-uuid-9012",
      "name": "Production API"
    },
    "project_name": "Production API",
    "branch": "main",
    "engine": "corgea-blast",
    "scan_type": "full",
    "status": "started",
    "pull_request_id": "42",
    "scan_url": "https://app.corgea.app/project/proj-uuid-9012/?scan_id=scan-uuid-7890",
    "true_positive_count": 0,
    "message": "Scan started for Production API (PR #42).",
    "scheduled_scan_ids": ["scheduled-scan-uuid"],
    "created_at": "2025-01-15T15:40:00.000Z"
  }
}

{
  "event_id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
  "event_type": "scan.completed",
  "timestamp": "2025-01-15T15:45:00.000Z",
  "data": {
    "company": "comp-uuid-1234",
    "scan_id": "scan-uuid-7890",
    "run_id": "run-12345",
    "project": {
      "id": "proj-uuid-9012",
      "name": "Production API"
    },
    "project_name": "Production API",
    "branch": "main",
    "engine": "corgea-blast",
    "scan_type": "full",
    "status": "completed",
    "pull_request_id": "42",
    "scan_url": "https://app.corgea.app/project/proj-uuid-9012/?scan_id=scan-uuid-7890",
    "true_positive_count": 5,
    "summary": {
      "total_issues": 8,
      "issues_with_fixes": 5,
      "issues_without_fixes": 3,
      "severity_breakdown": {
        "HI": {
          "name": "High",
          "count": 2
        },
        "ME": {
          "name": "Medium",
          "count": 6
        }
      },
      "classification_breakdown": [
        {
          "classification": "SQL Injection",
          "count": 2
        },
        {
          "classification": "Cross-Site Scripting (XSS)",
          "count": 1
        }
      ]
    },
    "message": "Scan completed for Production API (PR #42): 5 true-positive findings (5 with fixes). View: https://app.corgea.app/project/proj-uuid-9012/?scan_id=scan-uuid-7890",
    "scheduled_scan_ids": ["scheduled-scan-uuid"],
    "processed_at": "2025-01-15T15:45:00.000Z",
    "created_at": "2025-01-15T15:40:00.000Z"
  }
}

{
  "event_id": "c1d2e3f4-a5b6-7890-cdef-1234567890ab",
  "event_type": "scan.failed",
  "timestamp": "2025-01-15T15:42:00.000Z",
  "data": {
    "company": "comp-uuid-1234",
    "scan_id": "scan-uuid-7890",
    "run_id": "run-12345",
    "project": {
      "id": "proj-uuid-9012",
      "name": "Production API"
    },
    "project_name": "Production API",
    "branch": "main",
    "engine": "corgea-blast",
    "scan_type": "full",
    "status": "failed",
    "pull_request_id": "42",
    "scan_url": "https://app.corgea.app/project/proj-uuid-9012/?scan_id=scan-uuid-7890",
    "true_positive_count": 0,
    "error": "Scanner timed out",
    "scan_errors": null,
    "message": "Scan failed for Production API (PR #42): Scanner timed out. View: https://app.corgea.app/project/proj-uuid-9012/?scan_id=scan-uuid-7890",
    "scheduled_scan_ids": ["scheduled-scan-uuid"],
    "created_at": "2025-01-15T15:40:00.000Z"
  }
}

{
  "event_id": "c3d4e5f6-a7b8-9012-cdef-123456789012",
  "event_type": "issue.assigned",
  "timestamp": "2025-01-15T16:00:00.000Z",
  "data": {
    "company": "comp-uuid-1234",
    "issue_id": "issue-uuid-5678",
    "classification": "Cross-Site Scripting (XSS)",
    "urgency": "ME",
    "status": "open",
    "assigned_to": {
      "id": "user-uuid-1111",
      "email": "jane.doe@company.com",
      "name": "Jane Doe"
    },
    "previously_assigned_to": {
      "id": "user-uuid-2222",
      "email": "john.smith@company.com",
      "name": "John Smith"
    },
    "project": {
      "id": "proj-uuid-9012",
      "name": "Production API"
    },
    "url": "https://app.corgea.com/issue/issue-uuid-5678/"
  }
}

{
  "event_id": "f6a7b8c9-d0e1-2345-f012-345678901234",
  "event_type": "sla.violation",
  "timestamp": "2025-01-15T16:20:00.000Z",
  "data": {
    "company": "comp-uuid-1234",
    "sla": {
      "id": 3,
      "rule_type": "sca",
      "urgency": ["CR", "HI"],
      "remediation_days": 14,
      "escalation_days": 7
    },
    "notification_type": "escalation",
    "issue_kind": "SCA",
    "issue_count": 12,
    "summary_message": "Plain-text summary of breached issues...",
    "projects": [
      {
        "id": "proj-uuid-9012",
        "name": "Production API",
        "url": "https://app.corgea.com/project/proj-uuid-9012",
        "issue_count": 12,
        "urgency_counts": {
          "Critical": 4,
          "High": 8
        }
      }
    ]
  }
}

{
  "event_id": "d4e5f6a7-b8c9-0123-def0-123456789012",
  "event_type": "user.login",
  "timestamp": "2025-01-15T16:10:00.000Z",
  "data": {
    "company": "comp-uuid-1234",
    "user_id": 123,
    "username": "jane.doe",
    "email": "jane.doe@company.com",
    "first_name": "Jane",
    "last_name": "Doe",
    "user_agent": "Mozilla/5.0",
    "path": "/login/"
  }
}

{
  "event_id": "e5f6a7b8-c9d0-1234-ef01-234567890123",
  "event_type": "user.login_failed",
  "timestamp": "2025-01-15T16:12:00.000Z",
  "data": {
    "company": "comp-uuid-1234",
    "username": "jane.doe",
    "user_agent": "Mozilla/5.0",
    "path": "/login/"
  }
}

{
  "event_id": "3282dbbb-7392-476b-8ce2-19fc1070342c",
  "event_type": "scheduled_scan.daily_report",
  "timestamp": "2026-05-13T12:29:53.083616+00:00",
  "data": {
    "title": "🐕 Corgea Daily Scan Report",
    "company": "123",
    "company_name": "Acme Corp",
    "total_new_issues": 7,
    "message": "Daily scan report for Acme Corp: 7 new issues detected across 2 scan runs.",
    "scan_runs": [
      {
        "scheduled_scan_name": "Nightly API Scan",
        "project": "api-service",
        "new_issue_count": 5,
        "scan_url": "https://app.corgea.com/scans/abc123"
      },
      {
        "scheduled_scan_name": "Nightly Frontend Scan",
        "project": "frontend",
        "new_issue_count": 2,
        "scan_url": "https://app.corgea.com/scans/def456"
      }
    ]
  }
}