Webhooks

POST https://api.trypulse.tech/api/v1/webhooks
Authorization: Bearer $PULSE_TOKEN
X-Workspace-ID: $WORKSPACE_ID
Content-Type: application/json

{
  "label": "CI trigger",
  "url": "https://example.com/hooks/pulse",
  "all_teams": true,
  "resource_types": ["Issue", "Comment", "Project"]
}

{
  "action": "create",
  "type": "Issue",
  "actor": {
    "id": "68cab92a5020377746176588",
    "type": "user",
    "name": "Alireza Attari"
  },
  "created_at": "2026-05-10T16:06:33.656Z",
  "data": {
    "id": "6a00ad09f38fa921dd6bd682",
    "code": "PUL-13",
    "title": "User-configurable outbound webhooks",
    "description": "v1",
    "status": "in_progress",
    "priority": "high",
    "type": "feature",
    "team_id": "691897efbdac2591ea059cc4",
    "project_id": "6a3997a2125a6e096cc47dbe",
    "milestone_id": "6a3997a2125a6e096cc47dc0",
    "cycle_id": "6a3997a2125a6e096cc47dc1",
    "parent_id": "6a3997a2125a6e096cc47dc2",
    "reporter_id": "68cab92a5020377746176588",
    "assignee_id": "68d91d3629c051fe043158f9",
    "delegate_id": "6a00ef0e15d2cc6c31fb7044",
    "delegation_revision": 2,
    "label_ids": ["6a9be947a14f04b2f099951f"],
    "blocks_ids": ["6aab80e4eb36a3827400488d"],
    "blocked_by_ids": [],
    "time_estimate": 8,
    "due_date": "2026-10-01T00:00:00.000Z",
    "completed_at": null,
    "created_at": "2026-05-10T16:06:33.656Z",
    "updated_at": "2026-09-17T10:00:00.000Z"
  },
  "url": "https://app.trypulse.tech/pulse/issues/6a00ad09f38fa921dd6bd682",
  "workspace_id": "6a34cfb024a3b4ed28806e3b",
  "webhook_id": "66f1c0a5e4b0a1b2c3d4e5f6",
  "webhook_timestamp": 1789646400000
}

{
  "action": "update",
  "type": "Project",
  "actor": {
    "id": "68cab92a5020377746176588",
    "type": "user",
    "name": "Alireza Attari"
  },
  "created_at": "2026-09-17T10:00:00.000Z",
  "data": {
    "id": "6a3997a2125a6e096cc47dbe",
    "title": "Integrations",
    "description": "Webhooks and friends",
    "status": "in_progress",
    "priority": "medium",
    "health_status": "on_track",
    "owner_id": "68cab92a5020377746176588",
    "lead_id": null,
    "member_ids": ["68d91d3629c051fe043158f9"],
    "team_ids": ["691897efbdac2591ea059cc4", "68da1fb8af973c6419b9b3f7"],
    "initiative_id": null,
    "label_ids": [],
    "start_date": "2026-05-10T16:06:33.656Z",
    "target_date": "2026-10-01T00:00:00.000Z",
    "completed_at": null,
    "progress": 42,
    "created_at": "2026-05-10T16:06:33.656Z",
    "updated_at": "2026-09-17T10:00:00.000Z"
  },
  "updated_from": {
    "status": "ready",
    "updated_at": "2026-09-16T22:52:41.899Z"
  },
  "url": "https://app.trypulse.tech/pulse/projects/6a3997a2125a6e096cc47dbe",
  "workspace_id": "6a34cfb024a3b4ed28806e3b",
  "webhook_id": "66f1c0a5e4b0a1b2c3d4e5f6",
  "webhook_timestamp": 1789646400000
}

{
  "action": "create",
  "type": "Comment",
  "actor": {
    "id": "68cab92a5020377746176588",
    "type": "user",
    "name": "Alireza Attari"
  },
  "created_at": "2026-05-10T16:06:33.656Z",
  "data": {
    "id": "6aab8546eb36a382740048b9",
    "text": "Execution split",
    "author_id": "68cab92a5020377746176588",
    "target_type": "project",
    "target_id": "6a3997a2125a6e096cc47dbe",
    "parent_comment_id": null,
    "is_resolved": true,
    "mentioned_user_ids": [],
    "edited_at": null,
    "created_at": "2026-05-10T16:06:33.656Z",
    "updated_at": "2026-05-10T16:06:33.656Z"
  },
  "url": "https://app.trypulse.tech/pulse/projects/6a3997a2125a6e096cc47dbe#comment-6aab8546eb36a382740048b9",
  "workspace_id": "6a34cfb024a3b4ed28806e3b",
  "webhook_id": "66f1c0a5e4b0a1b2c3d4e5f6",
  "webhook_timestamp": 1789646400000
}

{
  "action": "create",
  "type": "Ping",
  "actor": {
    "id": "68cab92a5020377746176588",
    "type": "user",
    "name": "Alireza Attari"
  },
  "created_at": "2026-05-10T16:06:33.656Z",
  "data": {
    "webhook_id": "66f1c0a5e4b0a1b2c3d4e5f6",
    "label": "CI trigger"
  },
  "url": "",
  "workspace_id": "6a34cfb024a3b4ed28806e3b",
  "webhook_id": "66f1c0a5e4b0a1b2c3d4e5f6",
  "webhook_timestamp": 1789646400000
}

import crypto from "node:crypto";
import express from "express";

const SECRET = process.env.PULSE_WEBHOOK_SECRET;

function verifySignature(header, rawBody) {
  if (typeof header !== "string") return false;
  const expected = crypto.createHmac("sha256", SECRET).update(rawBody).digest("hex");
  const a = Buffer.from(header, "utf8");
  const b = Buffer.from(expected, "utf8");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

const app = express();

app.post(
  "/hooks/pulse",
  express.raw({ type: "application/json" }),
  (req, res) => {
    if (!verifySignature(req.get("pulse-signature"), req.body)) {
      return res.sendStatus(401);
    }

    const payload = JSON.parse(req.body.toString("utf8"));
    if (Math.abs(Date.now() - payload.webhook_timestamp) > 60_000) {
      return res.sendStatus(401);
    }

    // Handle payload.action / payload.type / payload.data
    return res.sendStatus(200);
  }
);

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"io"
	"net/http"
	"os"
	"time"
)

func main() {
	secret := os.Getenv("PULSE_WEBHOOK_SECRET")
	mux := http.NewServeMux()
	mux.HandleFunc("/hooks/pulse", func(w http.ResponseWriter, r *http.Request) {
		if r.Method != http.MethodPost {
			w.WriteHeader(http.StatusMethodNotAllowed)
			return
		}
		rawBody, err := io.ReadAll(r.Body)
		if err != nil {
			w.WriteHeader(http.StatusBadRequest)
			return
		}
		mac := hmac.New(sha256.New, []byte(secret))
		mac.Write(rawBody)
		expected := hex.EncodeToString(mac.Sum(nil))
		if !hmac.Equal([]byte(r.Header.Get("Pulse-Signature")), []byte(expected)) {
			w.WriteHeader(http.StatusUnauthorized)
			return
		}
		var payload struct {
			WebhookTimestamp int64 `json:"webhook_timestamp"`
		}
		if err := json.Unmarshal(rawBody, &payload); err != nil {
			w.WriteHeader(http.StatusBadRequest)
			return
		}
		skew := time.Now().UnixMilli() - payload.WebhookTimestamp
		if skew < 0 {
			skew = -skew
		}
		if skew > 60_000 {
			w.WriteHeader(http.StatusUnauthorized)
			return
		}
		w.WriteHeader(http.StatusOK)
	})
	http.ListenAndServe(":8080", mux)
}

import hashlib
import hmac
import json
import os
import time

from flask import Flask, request

SECRET = os.environ["PULSE_WEBHOOK_SECRET"]
app = Flask(__name__)


def verify(signature: str, raw_body: bytes, secret: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(signature, expected)


@app.post("/hooks/pulse")
def pulse_webhook():
    raw_body = request.get_data()
    signature = request.headers.get("Pulse-Signature", "")
    if not verify(signature, raw_body, SECRET):
        return ("", 401)
    payload = json.loads(raw_body)
    if abs(int(time.time() * 1000) - payload["webhook_timestamp"]) > 60_000:
        return ("", 401)
    return ("", 200)