Snooker API webhooks

The live events posted to your app, signed and retried.

On the paid plans, add up to ten endpoints in your account (Webhooks) and pick the events each one wants. Every live event of those types is then POSTed to it as JSON, in the same shape as the live feed, with test false.

POST /hooks/snooker
Content-Type: application/json
X-Snooker-Event: frame.won
X-Snooker-Signature: t=1791874000,v1=5f2c9a...

Check every delivery before you trust it: the HMAC-SHA256 of t, a full stop and the raw body, with the endpoint's secret, must equal v1, and t should be within five minutes of now.

// PHP
[$t, $v1] = sscanf($_SERVER['HTTP_X_SNOOKER_SIGNATURE'], 't=%d,v1=%s');
$body = file_get_contents('php://input');
$ok = hash_equals(hash_hmac('sha256', $t . '.' . $body, $secret), $v1) && abs(time() - $t) < 300;

# Python
t, v1 = (p.split('=', 1)[1] for p in sig.split(','))
ok = hmac.compare_digest(hmac.new(secret.encode(), f'{t}.{body}'.encode(), 'sha256').hexdigest(), v1)

Answer with any 2xx within ten seconds. Anything else is tried again eight times over about three days (after 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours, 12 hours and twice a day later). A refusal that will not change by itself, such as 404 or 410, stops that delivery at once. After twenty failures in a row the endpoint is paused and you are emailed; Resume in your account starts it again.

Endpoints must be https and reachable on the public internet. Send a test from your account to see a real recent event arrive, marked "test": true.