Webhooks

{
  "event": "unified-transaction-pool-sell-failed",
  "data": {
    "id": "00000000-0000-4000-8000-000000000021",
    "client_reference_id": "order-12345",
    "transaction_type": "POOL_SELL",
    "status": "FAILED",
    "reason_code": "BENEFICIARY_INSTRUMENT_REJECTED",
    "reason_desc": "beneficiary payment instrument was rejected on verification",
    "from_currency": "USDT",
    "to_currency": "INR",
    "from_amount": "1",
    "to_amount": null,
    "exchange_rate": null,
    "payment_method": "bank_transfer",
    "purpose_code": "P1301",
    "quote_id": null,
    "bank_transaction_id": null,
    "sender_id": "00000000-0000-4000-8000-000000000023",
    "beneficiary_id": "00000000-0000-4000-8000-000000000024",
    "beneficiary_instrument_id": "00000000-0000-4000-8000-000000000025",
    "beneficiary_instrument_type": "BANK_ACCOUNT",
    "beneficiary_relationship": "FAMILY",
    "created_at": 1793020135000,
    "updated_at": 1793020143000
  }
}

import hashlib
import hmac
import time

def verify(headers, webhook_client_id, webhook_secret, max_skew_seconds=300):
    client_id = headers.get("X-Api-Key", "")
    timestamp = headers.get("X-Timestamp", "")
    user_id = headers.get("X-User-Id", "")
    signature = headers.get("X-Signature", "")
    if not hmac.compare_digest(client_id, webhook_client_id):
        return False
    if not timestamp.isdigit() or abs(time.time() - int(timestamp)) > max_skew_seconds:
        return False
    expected = hmac.new(
        webhook_secret.encode(),
        (client_id + timestamp + user_id).encode(),
        hashlib.sha256,
    ).hexdigest().upper()
    return hmac.compare_digest(expected, signature.upper())