Webhooks for blockchains
everyone else forgot.

curl -X POST https://api.offthehook.dev/v1/subscriptions \
  -H "Authorization: Bearer $OTH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "destination": {
      "type": "https",
      "url":  "https://your-app.com/webhooks/tron"
    },
    "events": ["wallet.transfer.broadcasted"],
    "status": "enabled"
  }'

curl -X PATCH \
  https://api.offthehook.dev/v1/subscriptions/$SUB/filters/addresses \
  -H "Authorization: Bearer $OTH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "add": [
      { "chainId": "tron:mainnet", "address": "TQrZ9wBxn8..." },
      { "chainId": "tron:mainnet", "address": "TR7NHqjeKQ..." }
    ]
  }'

# Atomic + per-item validation:
# {
#   "results": {
#     "added":   [...],
#     "skipped": [{ "input": {...}, "reason": "duplicate" }]
#   }
# }

import { Webhook } from "svix";

const wh = new Webhook(process.env.WEBHOOK_SECRET!);

export async function POST(req: Request) {
  const body = await req.text();
  const headers = Object.fromEntries(req.headers);

  // Throws if signature is invalid.
  const event = wh.verify(body, headers);

  if (event.kind === "wallet.transfer.broadcasted") {
    const { from, to, amount, asset } = event.data;
    await ledger.recordIncoming({ from, to, amount, asset });
  }

  return new Response("ok", { status: 200 });
}

import (
    svix "github.com/svix/svix-webhooks/go"
)

func handle(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)
    wh, _ := svix.NewWebhook(os.Getenv("WEBHOOK_SECRET"))
    if err := wh.Verify(body, r.Header); err != nil {
        http.Error(w, "bad signature", 401)
        return
    }

    var evt struct {
        ID   string `json:"id"`
        Kind string `json:"kind"`
        Data json.RawMessage `json:"data"`
    }
    json.Unmarshal(body, &evt)
    // ... process
    w.WriteHeader(200)
}