Monitors for coding agents

const BASE = 'https://api.arcmira.com';
const H = {
  Authorization: `Bearer ${process.env.ARCMIRA_API_KEY}`,
  'Content-Type': 'application/json',
};

const { monitor } = await fetch(`${BASE}/v1/monitors`, {
  method: 'POST',
  headers: { ...H, 'Idempotency-Key': crypto.randomUUID() },
  body: JSON.stringify({ name: 'Competitor watch', icon: 'radar', color: 'indigo' }),
}).then(r => r.json());

const { tracker } = await fetch(`${BASE}/v1/trackers`, {
  method: 'POST',
  headers: { ...H, 'Idempotency-Key': crypto.randomUUID() },
  body: JSON.stringify({ entityName: 'Ramp', entityType: 'organization' }),
}).then(r => r.json());

await fetch(`${BASE}/v1/monitors/${monitor.id}/trackers`, {
  method: 'POST',
  headers: { ...H, 'Idempotency-Key': crypto.randomUUID() },
  body: JSON.stringify({ trackerIds: [tracker.id] }),
});

const { data: alerts } = await fetch(
  `${BASE}/v1/monitors/${monitor.id}/alerts?n=25`, { headers: H },
).then(r => r.json());

import os, uuid, httpx

BASE = 'https://api.arcmira.com'
H = {'Authorization': f"Bearer {os.environ['ARCMIRA_API_KEY']}"}

monitor = httpx.post(
    f'{BASE}/v1/monitors',
    json={'name': 'Competitor watch', 'icon': 'radar', 'color': 'indigo'},
    headers={**H, 'Idempotency-Key': str(uuid.uuid4())},
).json()['monitor']

tracker = httpx.post(
    f'{BASE}/v1/trackers',
    json={'entityName': 'Ramp', 'entityType': 'organization'},
    headers={**H, 'Idempotency-Key': str(uuid.uuid4())},
).json()['tracker']

httpx.post(
    f"{BASE}/v1/monitors/{monitor['id']}/trackers",
    json={'trackerIds': [tracker['id']]},
    headers={**H, 'Idempotency-Key': str(uuid.uuid4())},
)

alerts = httpx.get(f"{BASE}/v1/monitors/{monitor['id']}/alerts", params={'n': 25}, headers=H).json()['data']

curl -X POST 'https://api.arcmira.com/v1/monitors' \
  -H "Authorization: Bearer $ARCMIRA_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Competitor watch", "icon": "radar", "color": "indigo" }'

import { createHmac, timingSafeEqual } from 'node:crypto';
import express from 'express';

const app = express();

app.post(
  '/hooks/arcmira',
  express.raw({ type: 'application/json' }), // raw body is required
  (req, res) => {
    const secret = process.env.ARCMIRA_WEBHOOK_SECRET!.replace(/^whsec_/, '');
    const timestamp = req.header('X-Arcmira-Timestamp') ?? '';
    const signature = req.header('X-Arcmira-Signature') ?? '';

    if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
      return res.status(400).send('stale timestamp');
    }

    const expected = 'sha256=' + createHmac('sha256', secret)
      .update(`${timestamp}.${req.body.toString('utf8')}`)
      .digest('base64');

    const a = Buffer.from(signature);
    const b = Buffer.from(expected);
    if (a.length !== b.length || !timingSafeEqual(a, b)) {
      return res.status(401).send('bad signature');
    }

    const alert = JSON.parse(req.body.toString('utf8'));
    // handle alert.event === 'new_appearance' ...
    res.sendStatus(200);
  },
);

import base64, hashlib, hmac, os, time
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()
SECRET = os.environ['ARCMIRA_WEBHOOK_SECRET'].removeprefix('whsec_').encode()

@app.post('/hooks/arcmira')
async def arcmira_hook(request: Request):
    raw = await request.body()  # raw bytes, before parsing
    timestamp = request.headers.get('x-arcmira-timestamp', '')
    signature = request.headers.get('x-arcmira-signature', '')

    if abs(time.time() - int(timestamp or 0)) > 300:
        raise HTTPException(400, 'stale timestamp')

    digest = hmac.new(SECRET, f'{timestamp}.'.encode() + raw, hashlib.sha256).digest()
    expected = 'sha256=' + base64.b64encode(digest).decode()
    if not hmac.compare_digest(signature, expected):
        raise HTTPException(401, 'bad signature')

    alert = await request.json()
    # handle alert['event'] == 'new_appearance' ...
    return {'ok': True}