{"id":121256,"recorded_at":"2026-10-26T14:40:19.681160Z","observed_at":"2026-10-26T14:40:19.681111Z","subject_kind":"source_record","subject":"x402_bazaar:https://sicher.halowerk.com/v1/webhook-signature","kind":"listing","method":"baseline/1","body":{"endpoints":[["x402","https://sicher.halowerk.com/v1/webhook-signature"]],"name":"sicher.halowerk.com/v1/webhook-signature","owner_address":"0x2880edfff13100677bf97a3cbdf3bc34771c4e5e","raw":{"accepts":[{"amount":"2000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"asset":"USDC","assetTransferMethod":"eip3009","eip712Domain":{"chainId":8453,"name":"USD Coin","verifyingContract":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","version":"2"},"name":"USD Coin","network_name":"Base Mainnet","version":"2"},"maxTimeoutSeconds":300,"network":"eip155:8453","payTo":"0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E","scheme":"exact"}],"description":"Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a mismatch that looks exactly like an attack. This checks the signature the way the named provider actually specifies, with constant-time comparison, and returns the string that was signed so a mismatch can be debugged instead of guessed at.","extensions":{"bazaar":{"info":{"input":{"body":{"body":"{\"synthetic\":true,\"event\":\"documentation-example\"}","provider":"github","secret":"HALOWERK-public-synthetic-example-never-use-for-authentication","signature":"sha256=fdfaa7380ce9e369a7d90e8651603bb777a4f008dd3070b056d2b59122d602f8"},"bodyType":"json","method":"POST","type":"http"}},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"body":{"additionalProperties":false,"properties":{"body":{"description":"The raw request body exactly as received, not re-serialised.","maxLength":200000,"type":"string"},"headers":{"description":"All request headers; the right one is picked by provider.","type":"object"},"message_id":{"description":"Message id for schemes that sign one, e.g. Svix.","maxLength":200,"type":"string"},"provider":{"description":"Which provider signed the request.","enum":["github","stripe","shopify","slack","svix","generic_hmac"],"type":"string"},"secret":{"description":"The signing secret.","maxLength":2000,"minLength":1,"type":"string"},"signature":{"description":"The signature header value. Required unless headers is given.","maxLength":2000,"type":"string"},"timestamp":{"description":"Timestamp, if the provider signs one and it is not in the headers.","maxLength":40,"type":"string"},"tolerance_seconds":{"default":300,"description":"How old a signed timestamp may be.","maximum":86400,"minimum":1,"type":"integer"}},"required":["provider","body","secret"],"type":"object"},"bodyType":{"enum":["json","form-data","text"],"type":"string"},"method":{"enum":["POST","PUT","PATCH"],"type":"string"},"type":{"const":"http","type":"string"}},"required":["type","method","bodyType","body"],"type":"object"}},"required":["input"],"type":"object"}}},"lastUpdated":"2026-10-08T05:40:41.664Z","quality":{"l30DaysTotalCalls":3,"l30DaysUniquePayers":3,"lastCalledAt":"2026-10-08T05:40:41.242Z"},"resource":"https://sicher.halowerk.com/v1/webhook-signature","type":"http","x402Version":2},"source":"x402_bazaar","summary":"Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a mismatch that looks exactly like an attack. This checks the signature the way the named provider actually specifies, with constant-time comparison, and returns the string that was signed so a mismatch can be debugged instead of guessed at."},"body_sha256":"6a8438c4f30b81343e32ade7b73925b4250f3051ee6d3e9a28abb2b57f2ba5b1","prev_id":null,"leaf":"0x61357664716fb3bc06659bde10779aa00ad8120850338b36fcac7a227f777f23","leaf_text":"{\"body\":\"6a8438c4f30b81343e32ade7b73925b4250f3051ee6d3e9a28abb2b57f2ba5b1\",\"id\":121256,\"kind\":\"listing\",\"method\":\"baseline/1\",\"observed_us\":1793025619681111,\"prev\":null,\"subject\":\"x402_bazaar:https://sicher.halowerk.com/v1/webhook-signature\",\"subject_kind\":\"source_record\"}","day":{"day":"2026-10-26","leaves":296695,"root":"0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8","chained":"0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a","anchor_chain":"eip155:5042002","anchor_tx":"0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae","anchor_block":69251483},"proof":["0x6135dddd36fb410d44c8662ae6ce8909379ffb0a66381e407027747fda89d9aa","0xdeda1c8c3580799cf558ea3feab587b0787b04799a080e58af995f830af974e1","0x2fb2f89331ff87136b893f1a60ff2d10cd4a214e54df63e80bfc7143c9d883f1","0x78fa752d89b042e6af9900d879842caa44d6aeda07984db2cfd041c376ad0967","0xaf26019e51a68109baa1161c39575f6ba38eb964467c2469ba42822c619ea812","0xfb489120ab8dafe6bbb57bc3bd8f610cf9f0bc37879ab48217a760b74b35f247","0xbf4e0e23143df37bb8964d4734287805e79a0a70c8bbda18a9180c565ce69317","0xaefe332113201cb816d74994a30cf3a175f5786c155884fcdfb430d2b109cbe9","0x23d47664fa94c7855ae00ca65c51f506eeae8b0db1df0269cdac5186318cdff3","0xe260b2e40b95bbf4bea407155c3f0fd2821a2b48a48010e119c9c3a25f20adb5","0x52877ea072e10a1d3a921f7b54362005ad7a9baf5c99f31ec73a534bfea8930d","0xf4e3bedc99674db9d8ab4bc7655992ec76f822b327e6c89599b0baa3756fbd19","0x89fcaf55e37dd777228f271b79ea895534a66ec0d184363c2a6eb1b4d23c9ef1","0x216cebb9ae5414599109a02297c4817d7d1c6b1394afeb97efe38e32f0053974","0x7726154b91b2ad65b13849ef6cb6443b1f0ff113a3089c9bd5f2bcfc16be099d","0x47b89901b0f07938a6b9a66ddf35683903f79d756a7c7763665fd632758b08d0","0x9a83be955a206deb65b995adfd92c58fa31c95fbbf926bd199d300e70b08b26d","0x20704208aa6923d6b2450ef74ede87a6e0265d46447926038fe9506e9e154b2d","0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a"]}