Iġbed l-artikli tiegħek.
Ippubblikahom bil-mod tiegħek.

Kull talba

Authorization: Bearer sns_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Accept: application/json

Iċċekkja li jaħdem

curl https://seonis.ai/api/v1/me \
  -H "Authorization: Bearer $SEONIS_API_KEY"

{
  "organisation": { "id": 12, "name": "Peppervale", "country": "GB" },
  "key": {
    "name": "Production build",
    "prefix": "sns_live_ab",
    "created_at": "2026-09-06T09:12:44+00:00",
    "last_used_at": "2026-09-06T09:31:02+00:00"
  },
  "sites": 2
}

Rate limit

120 talbiet kull minuta, magħduda mal-key aktar milli mal-indirizz li tiġi minnu, għax build runners jaqsmu l-indirizzi. Aktar minn hekk tirċievi 429 bl-headers standard Retry-After u X-RateLimit. Il-ġbid tal-artikli għal build huwa biss ftit talbiet, għalhekk dan mhux limitu li għandek tilħaq bi żball.

Żomm il-key barra mir-repository tiegħek

Taqra dak kollu li ktibna għall-kont tiegħek, inklużi artikli li għadhom mhumiex ippubblikati. Poġġiha fil-build environment tiegħek, mhux fis-source tiegħek. Irrevokaha hawnhekk malli tkun xi mkien fejn m’għandhiex tkun, u kull ħaġa li tużaha tieħu 401 minnufih.

Tistgħu tużaw l-API mingħajr ma tqabbduha: l-endpoints jaħdmu għal kwalunkwe kont b'ċavetta. Li tqabbduha huwa kif il-bqija tal-prodott ikun jaf li għandu jieqaf jistenna indirizz tiegħu stess, u huwa dak li jwaqqaf artiklu li tippubblikaw intom stess milli jingħadd bħala falliment.

webhook-id: 7c1e2f0a-3b5d-4e8f-9a61-2d4c8b0e5f13
webhook-timestamp: 1790490600
webhook-signature: v1,s0RzLJ1d7Cxd9nwe8pqER9DWy/stEIB+uT9MlGVLlM0=

Header	X’inhu
webhook-id	Il-kunsinna, l-istess valur bħal delivery_id fil-body. Ftakar f’dawk li diġà pproċessajt, u wieġeb ripetizzjoni b’200 mingħajr ma terġa’ tagħmel ix-xogħol.
webhook-timestamp	Meta ffirmajnieh, f’sekondi sħaħ mill-1970. Irrifjuta kull ħaġa li tkun aktar minn ħames minuti differenti mill-arloġġ tiegħek, biex kunsinna qadima ma tkunx tista’ tintbagħatlek mill-ġdid.
webhook-signature	v1, imbagħad il-base64 HMAC-SHA256 tal-id, it-timestamp u l-body mhux ipproċessat magħqudin b’punti, magħmul biċ-ċavetta tal-firma tiegħek. Jista’ jkun hemm aktar minn waħda, separati bi spazji. Aċċetta l-kunsinna jekk taqbel xi waħda minnhom.

Iċ-ċavetta tal-firma

Tibda b’whsec_. Neħħi dak u agħmel base64-decode tal-bqija: dawk il-bytes huma ċ-ċavetta HMAC, mhux it-test li kkupjajt. Tintwera darba biss, meta tqabbad il-webhook jew tagħfas "New signing key" fil-paġna ta’ Publishing, u aħna qatt ma nibagħtuha.

Iċċekkja l-body mhux ipproċessat

Ikkalkula l-firma mill-bytes eżatt kif waslu, qabel ma xi ħaġa tipproċessahom. JSON li ġie decoded u encoded mill-ġdid mhumiex l-istess bytes, u l-firma tiegħu ma taqbilx.

PHP

<?php
$raw = getenv('SEONIS_SIGNING_KEY'); // whsec_...

// No key, no deliveries. A missing or empty variable would otherwise become
// an empty HMAC key, and anybody can sign with that.
$secret = is_string($raw) && str_starts_with($raw, 'whsec_')
    ? base64_decode(substr($raw, strlen('whsec_')), true)
    : false;

if ($secret === false || strlen($secret) < 24) {
    http_response_code(500);
    exit('Signing key not configured.');
}

$id        = $_SERVER['HTTP_WEBHOOK_ID'] ?? '';
$timestamp = $_SERVER['HTTP_WEBHOOK_TIMESTAMP'] ?? '';
$header    = $_SERVER['HTTP_WEBHOOK_SIGNATURE'] ?? '';
$body      = file_get_contents('php://input');

if (! ctype_digit($timestamp) || abs(time() - (int) $timestamp) > 300) {
    http_response_code(401);
    exit('Too old.');
}

$expected = base64_encode(hash_hmac('sha256', "$id.$timestamp.$body", $secret, true));

$valid = false;
foreach (explode(' ', $header) as $signature) {
    [$version, $value] = array_pad(explode(',', $signature, 2), 2, '');
    $valid = $valid || ($version === 'v1' && hash_equals($expected, $value));
}

if (! $valid) {
    http_response_code(401);
    exit('Bad signature.');
}

$delivery = json_decode($body, true);

Node.js

import crypto from 'node:crypto';
import express from 'express';

const app = express();

// No key, no server. An empty variable would otherwise become an empty HMAC
// key, and anybody can sign with that.
const raw = process.env.SEONIS_SIGNING_KEY ?? '';
if (!raw.startsWith('whsec_')) throw new Error('SEONIS_SIGNING_KEY is not set.');
const key = Buffer.from(raw.slice('whsec_'.length), 'base64');
if (key.length < 24) throw new Error('SEONIS_SIGNING_KEY is not a valid key.');

// express.raw keeps the body as the bytes we signed.
app.post('/hooks/seonis', express.raw({ type: 'application/json' }), (req, res) => {
  const id = req.get('webhook-id') ?? '';
  const timestamp = req.get('webhook-timestamp') ?? '';
  const header = req.get('webhook-signature') ?? '';

  if (!/^\d+$/.test(timestamp) || Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return res.status(401).send('Too old.');
  }

  const expected = crypto.createHmac('sha256', key)
    .update(`${id}.${timestamp}.`)
    .update(req.body)
    .digest();

  const valid = header.split(' ').some((signature) => {
    const [version, value = ''] = signature.split(',');
    const given = Buffer.from(value, 'base64');
    return version === 'v1' && given.length === expected.length && crypto.timingSafeEqual(given, expected);
  });

  if (!valid) return res.status(401).send('Bad signature.');

  const delivery = JSON.parse(req.body);
  res.json({ ok: true });
});

Jew uża librerija

Il-libreriji uffiċjali ta’ Standard Webhooks, għal PHP, JavaScript, Python, Go, Ruby u oħrajn, jagħmlu dan kollu b’sejħa waħda. Agħtihom iċ-ċavetta tal-firma kif intwerietlek, inkluż whsec_. github.com/standard-webhooks

Il-headers l-antiki

Il-kunsinni jġorru wkoll is-sigriet tal-firma bħala bearer token, u X-AutoSEO-LT-Signature, HMAC tal-body biss magħmul b’dak is-sigriet. Dawn għadhom jintbagħtu biex endpoints mibnija fuqhom jibqgħu jaħdmu. Endpoint ġdid għandu minflok jiċċekkja webhook-signature: il-firma l-qadima ma tkoprix ħin u lanqas id, u ċ-ċavetta tagħha tivvjaġġa f’kull talba.

Il-formats AutoSEO, Outrank u BabyLoveGrowth jibagħtu eżatt dak li bagħtu dawk is-servizzi, għalhekk ma jġorrux dawn il-headers.