Webhooks

curl -X POST "https://app.spacekru.com/api/public/v1/subscriptions" \
  -H "Authorization: Bearer $SPACEKRU_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "event_type": "lead.created",
  "target_url": "https://hooks.zapier.com/hooks/catch/1234567/abcdefg/"
}'

const res = await fetch('https://app.spacekru.com/api/public/v1/subscriptions', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.SPACEKRU_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "event_type": "lead.created",
    "target_url": "https://hooks.zapier.com/hooks/catch/1234567/abcdefg/"
  }),
});
const body = await res.json();
if (!res.ok) {
  // Branch on body.error.code; quote body.error.request_id to support.
  throw new Error(`${body.error.code}: ${body.error.message} (request ${body.error.request_id})`);
}
console.log(body);

import os

import requests

r = requests.post(
    "https://app.spacekru.com/api/public/v1/subscriptions",
    headers={
        "Authorization": f"Bearer {os.environ['SPACEKRU_API_KEY']}",
    },
    json={
        "event_type": "lead.created",
        "target_url": "https://hooks.zapier.com/hooks/catch/1234567/abcdefg/",
    },
    timeout=30,
)
body = r.json()
if not r.ok:
    # Branch on body["error"]["code"]; quote body["error"]["request_id"] to support.
    raise RuntimeError(f"{body['error']['code']}: {body['error']['message']} (request {body['error']['request_id']})")
print(body)

{
  "object": "subscription",
  "id": "0a1b2c3d-4e5f-4a6b-9c7d-8e9f0a1b2c3d",
  "event_type": "lead.created",
  "target_url": "https://hooks.zapier.com/hooks/catch/1234567/abcdefg/",
  "is_active": true,
  "failure_count": 0,
  "disabled_reason": null,
  "last_success_at": null,
  "created_at": "2026-10-19T14:40:00.000Z",
  "exclude_own_changes": false,
  "secret": "whsec_EXAMPLE0nlyN0tARealSecretDoNotUseIt00000"
}

curl -X POST "https://app.spacekru.com/api/public/v1/subscriptions" \
  -H "Authorization: Bearer $SPACEKRU_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "event_type": "lead.updated",
  "target_url": "https://hooks.zapier.com/hooks/catch/1234567/abcdefg/",
  "exclude_own_changes": true
}'

const res = await fetch('https://app.spacekru.com/api/public/v1/subscriptions', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.SPACEKRU_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "event_type": "lead.updated",
    "target_url": "https://hooks.zapier.com/hooks/catch/1234567/abcdefg/",
    "exclude_own_changes": true
  }),
});
const body = await res.json();
if (!res.ok) {
  // Branch on body.error.code; quote body.error.request_id to support.
  throw new Error(`${body.error.code}: ${body.error.message} (request ${body.error.request_id})`);
}
console.log(body);

import os

import requests

r = requests.post(
    "https://app.spacekru.com/api/public/v1/subscriptions",
    headers={
        "Authorization": f"Bearer {os.environ['SPACEKRU_API_KEY']}",
    },
    json={
        "event_type": "lead.updated",
        "target_url": "https://hooks.zapier.com/hooks/catch/1234567/abcdefg/",
        "exclude_own_changes": True,
    },
    timeout=30,
)
body = r.json()
if not r.ok:
    # Branch on body["error"]["code"]; quote body["error"]["request_id"] to support.
    raise RuntimeError(f"{body['error']['code']}: {body['error']['message']} (request {body['error']['request_id']})")
print(body)

curl "https://app.spacekru.com/api/public/v1/subscriptions" \
  -H "Authorization: Bearer $SPACEKRU_API_KEY"

const res = await fetch('https://app.spacekru.com/api/public/v1/subscriptions', {
  headers: {
    Authorization: `Bearer ${process.env.SPACEKRU_API_KEY}`,
  },
});
const body = await res.json();
if (!res.ok) {
  // Branch on body.error.code; quote body.error.request_id to support.
  throw new Error(`${body.error.code}: ${body.error.message} (request ${body.error.request_id})`);
}
console.log(body);

import os

import requests

r = requests.get(
    "https://app.spacekru.com/api/public/v1/subscriptions",
    headers={
        "Authorization": f"Bearer {os.environ['SPACEKRU_API_KEY']}",
    },
    timeout=30,
)
body = r.json()
if not r.ok:
    # Branch on body["error"]["code"]; quote body["error"]["request_id"] to support.
    raise RuntimeError(f"{body['error']['code']}: {body['error']['message']} (request {body['error']['request_id']})")
print(body)

curl -X DELETE "https://app.spacekru.com/api/public/v1/subscriptions/0a1b2c3d-4e5f-4a6b-9c7d-8e9f0a1b2c3d" \
  -H "Authorization: Bearer $SPACEKRU_API_KEY"

const res = await fetch('https://app.spacekru.com/api/public/v1/subscriptions/0a1b2c3d-4e5f-4a6b-9c7d-8e9f0a1b2c3d', {
  method: 'DELETE',
  headers: {
    Authorization: `Bearer ${process.env.SPACEKRU_API_KEY}`,
  },
});
const body = await res.json();
if (!res.ok) {
  // Branch on body.error.code; quote body.error.request_id to support.
  throw new Error(`${body.error.code}: ${body.error.message} (request ${body.error.request_id})`);
}
console.log(body);

import os

import requests

r = requests.delete(
    "https://app.spacekru.com/api/public/v1/subscriptions/0a1b2c3d-4e5f-4a6b-9c7d-8e9f0a1b2c3d",
    headers={
        "Authorization": f"Bearer {os.environ['SPACEKRU_API_KEY']}",
    },
    timeout=30,
)
body = r.json()
if not r.ok:
    # Branch on body["error"]["code"]; quote body["error"]["request_id"] to support.
    raise RuntimeError(f"{body['error']['code']}: {body['error']['message']} (request {body['error']['request_id']})")
print(body)

{
  "id": "e4d3c2b1-a098-4765-8432-10fedcba9876",
  "event": "lead.updated",
  "occurred_at": "2026-10-19T14:32:11.000Z",
  "organization_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "changes": {
    "status": [
      "new",
      "contacted"
    ],
    "job_title": [
      "Operations Manager",
      "Head of Operations"
    ]
  },
  "triggered_by": {
    "type": "app",
    "api_key_id": null
  },
  "data": {
    "object": "lead",
    "id": "3f2b8c1e-9a4d-4e6f-b7a8-1c2d3e4f5a6b",
    "type": "person",
    "full_name": "Maria Lopez",
    "business_name": null,
    "job_title": "Head of Operations",
    "work_email": "maria.lopez@example.com",
    "personal_email": null,
    "work_phone": "+13055550142",
    "personal_phone": null,
    "company_name": "Acme Corp",
    "city": "Miami",
    "country": "United States",
    "status": "contacted",
    "source": "api",
    "tags": [
      "typeform",
      "spring-promo"
    ],
    "instagram_profile": null,
    "linkedin_profile_url": null,
    "website": null,
    "external_id": "crm-88412",
    "created_at": "2026-10-19T14:32:10.000Z",
    "updated_at": "2026-10-19T14:32:10.000Z"
  }
}

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const SECRET = process.env.SPACEKRU_WEBHOOK_SECRET; // the FULL value, including "whsec_"
const TOLERANCE_SECONDS = 300;
const seen = new Set(); // use your database or Redis in production

// Use the RAW body: re-serialized JSON will not match the signature.
app.post('/webhooks/spacekru', express.raw({ type: 'application/json' }), (req, res) => {
  const timestamp = req.get('X-SpaceKru-Timestamp') ?? '';
  const header = req.get('X-SpaceKru-Signature') ?? '';
  const deliveryId = req.get('X-SpaceKru-Delivery') ?? '';

  if (!/^\d+$/.test(timestamp) || !header.startsWith('sha256=')) {
    return res.status(400).send('Missing signature');
  }
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > TOLERANCE_SECONDS) {
    return res.status(400).send('Stale timestamp');
  }

  const expected = crypto
    .createHmac('sha256', SECRET)
    .update(`${timestamp}.`)
    .update(req.body) // Buffer with the raw bytes
    .digest();
  const received = Buffer.from(header.slice('sha256='.length), 'hex');
  if (received.length !== expected.length || !crypto.timingSafeEqual(received, expected)) {
    return res.status(400).send('Invalid signature');
  }

  // Answer within 8 seconds; do the work afterwards.
  res.sendStatus(200);

  if (seen.has(deliveryId)) return; // retries reuse the same delivery id
  seen.add(deliveryId);
  const event = JSON.parse(req.body.toString('utf8'));
  console.log(event.event, event.data.id, event.changes);
});

app.listen(3000);

import hashlib
import hmac
import os
import time

from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["SPACEKRU_WEBHOOK_SECRET"].encode()  # the FULL value, including "whsec_"
TOLERANCE_SECONDS = 300
seen = set()  # use your database or Redis in production


@app.post("/webhooks/spacekru")
def spacekru_webhook():
    timestamp = request.headers.get("X-SpaceKru-Timestamp", "")
    header = request.headers.get("X-SpaceKru-Signature", "")
    delivery_id = request.headers.get("X-SpaceKru-Delivery", "")
    raw = request.get_data()  # raw bytes, read BEFORE parsing JSON

    if not timestamp.isdigit() or not header.startswith("sha256="):
        abort(400, "Missing signature")
    if abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
        abort(400, "Stale timestamp")

    expected = hmac.new(SECRET, timestamp.encode() + b"." + raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, header[len("sha256="):]):
        abort(400, "Invalid signature")

    if delivery_id not in seen:  # retries reuse the same delivery id
        seen.add(delivery_id)
        event = request.get_json()
        print(event["event"], event["data"]["id"], event["changes"])  # queue it for processing

    return "", 200  # answer within 8 seconds