{ "openapi": "3.0.1", "info": { "title": "Webhook Receiver Contract and Signature Rotation Verifier", "description": "Sends signed and deliberately bad deliveries to one webhook receiver and reports, for each case, whether the receiver answered with the expected HTTP status. Use it after a deploy and after a secret rotation. HTTP only, no browser, no proxy.", "version": "0.1", "x-build-id": "j9H0rIz8idiQF1DWq" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/kingii98~webhook-receiver-contract-and-signature-rotation-verifier/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-kingii98-webhook-receiver-contract-and-signature-rotation-verifier", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/kingii98~webhook-receiver-contract-and-signature-rotation-verifier/runs": { "post": { "operationId": "runs-sync-kingii98-webhook-receiver-contract-and-signature-rotation-verifier", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/kingii98~webhook-receiver-contract-and-signature-rotation-verifier/run-sync": { "post": { "operationId": "run-sync-kingii98-webhook-receiver-contract-and-signature-rotation-verifier", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "receiverUrl" ], "properties": { "receiverUrl": { "title": "Receiver URL", "type": "string", "description": "One public HTTPS endpoint that you own. Every test case is sent to this URL with POST. Private, loopback and reserved addresses are refused. Redirects are not followed: a 3xx answer is reported as it is.", "default": "https://postman-echo.com/post" }, "signatureScheme": { "title": "Signature scheme", "enum": [ "hmac_sha256", "hmac_sha1", "none" ], "type": "string", "description": "Algorithm used to sign the request body. Select \"none\" for a receiver that does not check a signature.", "default": "hmac_sha256" }, "signatureHeader": { "title": "Signature header name", "pattern": "^[\\x20-\\x7E]*$", "type": "string", "description": "Name of the header that carries the signature, for example \"X-Hub-Signature-256\" or \"Stripe-Signature\". ASCII characters only.", "default": "X-Signature-256" }, "signatureTemplate": { "title": "Signature header value template", "pattern": "^[\\x20-\\x7E]*$", "type": "string", "description": "Format of the signature header value. Use {signature} for the lower-case hexadecimal digest, {signatureBase64} for the base64 digest and {timestamp} for the Unix timestamp in seconds. ASCII characters only.", "default": "sha256={signature}" }, "signedPayloadTemplate": { "title": "Signed payload template", "type": "string", "description": "Bytes that the receiver signs. Use {body} for the request body and {timestamp} for the Unix timestamp in seconds. Example for a timestamped scheme: {timestamp}.{body}", "default": "{body}" }, "timestampHeader": { "title": "Timestamp header name", "pattern": "^[\\x20-\\x7E]*$", "type": "string", "description": "Name of the header that carries the Unix timestamp in seconds. Leave it empty when the receiver does not read a timestamp header. ASCII characters only.", "default": "X-Timestamp" }, "currentSecret": { "title": "Current signing secret", "type": "string", "description": "The secret that the receiver must accept now. It is used for the \"valid\" cases. An empty value is allowed: the Actor then signs with an empty key." }, "previousSecret": { "title": "Previous signing secret", "type": "string", "description": "The secret that the receiver must reject after a rotation. It is used for the \"previous-secret\" cases and probes. Leave it empty when you do not verify a rotation." }, "cases": { "title": "Test cases", "minItems": 1, "maxItems": 50, "type": "array", "description": "1 to 50 test cases. Each case holds a name, a payload, a signature mode (valid, missing, wrong-secret, previous-secret, replayed-timestamp, oversized-body) and the expected HTTP status range.", "default": [ { "name": "good-delivery", "mode": "valid", "payload": { "event": "ping", "id": "{nonce}", "sentAt": "{timestamp}" }, "expectedStatusMin": 200, "expectedStatusMax": 299 }, { "name": "no-signature-header", "mode": "missing", "payload": { "event": "ping", "id": "{nonce}", "sentAt": "{timestamp}" }, "expectedStatusMin": 200, "expectedStatusMax": 299 }, { "name": "wrong-secret", "mode": "wrong-secret", "payload": { "event": "ping", "id": "{nonce}", "sentAt": "{timestamp}" }, "expectedStatusMin": 200, "expectedStatusMax": 299 } ] }, "tamperReplayProbes": { "title": "Send tamper and replay probes", "type": "boolean", "description": "Add a probe set of four extra requests for each executed case: tampered body, tampered signature, replayed timestamp and previous secret. Each probe set is charged as one tamper-replay-probe event.", "default": false }, "probeExpectedStatusMin": { "title": "Probe expected status, lowest", "minimum": 100, "maximum": 599, "type": "integer", "description": "Lowest HTTP status that counts as a correct rejection of a tamper or replay probe.", "default": 400 }, "probeExpectedStatusMax": { "title": "Probe expected status, highest", "minimum": 100, "maximum": 599, "type": "integer", "description": "Highest HTTP status that counts as a correct rejection of a tamper or replay probe.", "default": 499 }, "timeoutSeconds": { "title": "Request timeout (seconds)", "minimum": 1, "maximum": 15, "type": "integer", "description": "Timeout for one request to the receiver.", "default": 10 }, "maxRequests": { "title": "Maximum requests", "minimum": 1, "maximum": 500, "type": "integer", "description": "Hard cap on the number of requests sent to the receiver in one run. Cases that do not fit the cap are reported as not-executed.", "default": 200 }, "requestsPerSecond": { "title": "Requests per second", "minimum": 1, "maximum": 10, "type": "integer", "description": "Rate limit for the receiver. Requests are sent one after the other, so this Actor cannot act as a load generator.", "default": 5 }, "maxResponseBytes": { "title": "Maximum response bytes", "minimum": 1024, "maximum": 1000000, "type": "integer", "description": "Hard cap on the response bytes read from the receiver. The response body hash covers the bytes that were read.", "default": 65536 }, "oversizedBodyBytes": { "title": "Oversized body size (bytes)", "minimum": 1000, "maximum": 1000000, "type": "integer", "description": "Size of the padded body used by the \"oversized-body\" signature mode.", "default": 100000 }, "replayAgeSeconds": { "title": "Replay age (seconds)", "minimum": 60, "maximum": 86400, "type": "integer", "description": "Age of the stale timestamp used by the \"replayed-timestamp\" mode and by the replay probe. A receiver with a timestamp window must reject it.", "default": 900 }, "contentType": { "title": "Content type", "pattern": "^[\\x20-\\x7E]*$", "type": "string", "description": "Content-Type header sent with every request body. ASCII characters only.", "default": "application/json" }, "userAgent": { "title": "User agent", "pattern": "^[\\x20-\\x7E]*$", "type": "string", "description": "User-Agent header sent with every request, so your receiver can identify this Actor in its logs. ASCII characters only.", "default": "WebhookContractVerifier/0.1 (+https://apify.com)" } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } }