API Documentation

Mark an incident as resolved.

curl -X POST "https://app.reputatic.com/api/v1/incidents/1/resolve" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json"

Webhook Payload Structure

All webhook events follow this structure:

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "type": "blacklist.hit",
  "created_at": "2025-10-20T12:00:00Z",
  "data": {
    "subnet": {
      "id": 42,
      "cidr": "192.168.1.0/24",
      "reputation_score": 65
    },
    "blacklist": {
      "name": "bl.spamcop.net",
      "ip": "192.168.1.100",
      "detected_at": "2025-10-20T12:00:00Z"
    }
  },
  "account": {
    "id": 1,
    "email": "[email protected]"
  }
}

Request Headers

Every webhook request includes these headers:

Content-Type: application/json
User-Agent: Reputatic-Webhooks/1.0
X-Reputatic-Event: blacklist.hit
X-Reputatic-Signature: <hmac_sha256_signature>
X-Reputatic-Delivery: 12345
X-Reputatic-Timestamp: 1697811600

Signature Verification

Verify webhook authenticity using HMAC SHA-256 signatures:

<?php
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_REPUTATIC_SIGNATURE'];
$secret = 'whsec_your_secret_here';

$expected = hash_hmac('sha256', $payload, $secret);
if (hash_equals($expected, $signature)) {
    // Signature valid
    $data = json_decode($payload, true);
    // Process webhook...
    http_response_code(200);
} else {
    http_response_code(401);
}

const crypto = require('crypto');

app.post('/webhooks', express.raw({type: 'application/json'}), (req, res) => {
  const signature = req.headers['x-reputatic-signature'];
  const secret = 'whsec_your_secret_here';
  
  const expected = crypto
    .createHmac('sha256', secret)
    .update(req.body)
    .digest('hex');
  
  if (crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) {
    const event = JSON.parse(req.body.toString());
    // Process webhook...
    res.status(200).send('OK');
  } else {
    res.status(401).send('Invalid signature');
  }
});

import hmac
import hashlib

@app.route('/webhooks', methods=['POST'])
def handle_webhook():
    payload = request.data
    signature = request.headers.get('X-Reputatic-Signature')
    secret = 'whsec_your_secret_here'
    
    expected = hmac.new(
        secret.encode(),
        payload,
        hashlib.sha256
    ).hexdigest()
    
    if hmac.compare_digest(expected, signature):
        event = request.json
        # Process webhook...
        return 'OK', 200
    else:
        return 'Invalid signature', 401

Retry Logic

If your endpoint fails or returns a non-2xx status, Reputatic automatically retries:

💡 Endpoints are auto-disabled after 10 consecutive failures