External API

GET /api/v1/logs

{
  "data": [
    {
      "id": "log_abc123",
      "workflowId": "wf_xyz789",
      "executionId": "exec_def456",
      "level": "info",
      "trigger": "api",
      "startedAt": "2025-01-01T12:34:56.789Z",
      "endedAt": "2025-01-01T12:34:57.123Z",
      "totalDurationMs": 334,
      "cost": {
        "total": 0.00234
      },
      "files": null
    }
  ],
  "nextCursor": "eyJzIjoiMjAyNS0wMS0wMVQxMjozNDo1Ni43ODlaIiwiaWQiOiJsb2dfYWJjMTIzIn0",
  "limits": {
    "executionRateLimit": {
      "sync": {
        "limit": 60,
        "remaining": 58,
        "resetAt": "2025-01-01T12:35:56.789Z"
      },
      "async": {
        "limit": 60,
        "remaining": 59,
        "resetAt": "2025-01-01T12:35:56.789Z"
      }
    },
    "usage": {
      "currentPeriodCost": 1.234,
      "limit": 10,
      "tier": {
        "id": "tier_pro",
        "displayName": "Pro"
      },
      "isExceeded": false
    }
  }
}

GET /api/v1/logs/{id}

{
  "data": {
    "id": "log_abc123",
    "workflowId": "wf_xyz789",
    "executionId": "exec_def456",
    "level": "info",
    "trigger": "api",
    "startedAt": "2025-01-01T12:34:56.789Z",
    "endedAt": "2025-01-01T12:34:57.123Z",
    "totalDurationMs": 334,
    "workflow": {
      "id": "wf_xyz789",
      "name": "My Workflow",
      "description": "Process customer data",
      "color": "#2dd4bf",
      "folderId": "folder_123",
      "userId": "user_123",
      "workspaceId": "workspace_123",
      "createdAt": "2025-01-01T10:00:00.000Z",
      "updatedAt": "2025-01-01T11:00:00.000Z"
    },
    "executionData": {
      "traceSpans": [...],
      "finalOutput": {...}
    },
    "cost": {
      "total": 0.00234,
      "tokens": {
        "prompt": 123,
        "completion": 456,
        "total": 579
      },
      "models": {
        "gpt-4o": {
          "input": 0.001,
          "output": 0.00134,
          "total": 0.00234,
          "tokens": {
            "prompt": 123,
            "completion": 456,
            "total": 579
          }
        }
      }
    },
    "createdAt": "2025-01-01T12:34:57.200Z"
  },
  "limits": {
      "executionRateLimit": {
        "sync": {
          "limit": 60,
          "remaining": 58,
          "resetAt": "2025-01-01T12:35:56.789Z"
        },
        "async": {
          "limit": 60,
          "remaining": 59,
          "resetAt": "2025-01-01T12:35:56.789Z"
        }
      },
      "usage": {
        "currentPeriodCost": 1.234,
        "limit": 10,
        "tier": {
          "id": "tier_pro",
          "displayName": "Pro"
        },
        "isExceeded": false
      }
    }
}

GET /api/v1/logs/executions/{executionId}

{
  "executionId": "exec_def456",
  "workflowId": "wf_xyz789",
  "workflowState": {
    "blocks": {...},
    "edges": [...],
    "loops": {...},
    "parallels": {...}
  },
  "executionMetadata": {
    "trigger": "api",
    "startedAt": "2025-01-01T12:34:56.789Z",
    "endedAt": "2025-01-01T12:34:57.123Z",
    "totalDurationMs": 334,
    "cost": {...}
  },
  "limits": {
    "executionRateLimit": {
      "sync": {
        "limit": 60,
        "remaining": 58,
        "resetAt": "2025-01-01T12:35:56.789Z"
      },
      "async": {
        "limit": 60,
        "remaining": 59,
        "resetAt": "2025-01-01T12:35:56.789Z"
      }
    },
    "usage": {
      "currentPeriodCost": 1.234,
      "limit": 10,
      "tier": {
        "id": "tier_pro",
        "displayName": "Pro"
      },
      "isExceeded": false
    }
  }
}

import crypto from 'crypto';
import { DatabaseSync } from 'node:sqlite';
import express from 'express';

const app = express();
const db = new DatabaseSync(process.env.WEBHOOK_DB_PATH || 'webhooks.sqlite', { timeout: 5000 });
db.exec(`
  CREATE TABLE IF NOT EXISTS webhook_receipts (
    delivery_id TEXT PRIMARY KEY,
    event_type TEXT NOT NULL,
    workflow_id TEXT NOT NULL,
    execution_id TEXT NOT NULL,
    UNIQUE (event_type, workflow_id, execution_id)
  )
`);
const claimDelivery = db.prepare(`
  INSERT INTO webhook_receipts (delivery_id, event_type, workflow_id, execution_id)
  VALUES (?, ?, ?, ?) ON CONFLICT DO NOTHING
`);

function verifyWebhookSignature(rawBody, signature, secret) {
  if (!signature || !secret) return false;
  const [timestampPart, signaturePart] = signature.split(',');
  if (!timestampPart || !signaturePart) return false;
  const timestamp = timestampPart.replace('t=', '');
  const expectedSignature = signaturePart.replace('v1=', '');

  const computedSignature = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  const computed = Buffer.from(computedSignature, 'hex');
  const expected = Buffer.from(expectedSignature, 'hex');
  return computed.length === expected.length && crypto.timingSafeEqual(computed, expected);
}

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['tradinggoose-signature'];
  const rawBody = req.body.toString('utf8');

  if (!verifyWebhookSignature(rawBody, signature, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  const deliveryHeader = req.headers['tradinggoose-delivery-id'];
  const deliveryId = req.headers['idempotency-key'] || deliveryHeader;
  if (typeof deliveryId !== 'string' || !deliveryId.trim() ||
      (deliveryHeader && deliveryHeader !== deliveryId)) {
    return res.status(400).send('Missing or inconsistent delivery ID');
  }

  let event;
  try {
    event = JSON.parse(rawBody);
  } catch {
    return res.status(400).send('Invalid JSON');
  }
  if (event?.type !== 'workflow.execution.completed' ||
      typeof event.data?.workflowId !== 'string' || !event.data.workflowId ||
      typeof event.data?.executionId !== 'string' || !event.data.executionId) {
    return res.status(400).send('Invalid event');
  }

  try {
    db.exec('BEGIN IMMEDIATE');
    const receipt = claimDelivery.run(deliveryId, event.type, event.data.workflowId, event.data.executionId);
    if (receipt.changes === 0) {
      db.exec('COMMIT');
      return res.sendStatus(200);
    }
    // Apply your database side effects here using db, inside this transaction.
    db.exec('COMMIT');
  } catch (error) {
    if (db.isTransaction) db.exec('ROLLBACK');
    console.error('Webhook processing failed', error);
    return res.sendStatus(500);
  }
  res.sendStatus(200);
});

import hmac
import hashlib
import os
import sqlite3
from contextlib import closing
from flask import Flask, request

app = Flask(__name__)
database_path = os.environ.get('WEBHOOK_DB_PATH', 'webhooks.sqlite')
with closing(sqlite3.connect(database_path)) as db, db:
    db.execute('''
        CREATE TABLE IF NOT EXISTS webhook_receipts (
            delivery_id TEXT PRIMARY KEY,
            event_type TEXT NOT NULL,
            workflow_id TEXT NOT NULL,
            execution_id TEXT NOT NULL,
            UNIQUE (event_type, workflow_id, execution_id)
        )
    ''')

def verify_webhook_signature(raw_body: str, signature: str, secret: str) -> bool:
    if not signature or not secret:
        return False
    timestamp_part, separator, signature_part = signature.partition(',')
    if not separator:
        return False
    timestamp = timestamp_part.replace('t=', '')
    expected_signature = signature_part.replace('v1=', '')

    signature_base = f"{timestamp}.{raw_body}"
    computed_signature = hmac.new(
        secret.encode(),
        signature_base.encode(),
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(computed_signature, expected_signature)

@app.route('/webhook', methods=['POST'])
def webhook():
    signature = request.headers.get('tradinggoose-signature')
    raw_body = request.get_data(as_text=True)

    if not verify_webhook_signature(raw_body, signature, os.environ['WEBHOOK_SECRET']):
        return 'Invalid signature', 401

    event = request.get_json()
    delivery_header = request.headers.get('tradinggoose-delivery-id')
    delivery_id = request.headers.get('Idempotency-Key') or delivery_header
    if not delivery_id or not delivery_id.strip() or (
        delivery_header and delivery_header != delivery_id
    ):
        return 'Missing or inconsistent delivery ID', 400
    data = event.get('data') if isinstance(event, dict) else None
    if not isinstance(data, dict) or event.get('type') != 'workflow.execution.completed' or any(
        not isinstance(data.get(key), str) or not data[key]
        for key in ('workflowId', 'executionId')
    ):
        return 'Invalid event', 400

    try:
        with closing(sqlite3.connect(database_path, timeout=5)) as db, db:
            db.execute('BEGIN IMMEDIATE')
            receipt = db.execute('''
                INSERT INTO webhook_receipts (delivery_id, event_type, workflow_id, execution_id)
                VALUES (?, ?, ?, ?) ON CONFLICT DO NOTHING
            ''', (delivery_id, event['type'], data['workflowId'], data['executionId']))
            if receipt.rowcount == 0:
                return '', 200
            # Apply your database side effects here using db, inside this transaction.
    except Exception:
        app.logger.exception('Webhook processing failed')
        return '', 500
    return '', 200