REST API for corporate BTC + ETH treasuries

curl -X POST https://www.corpstacking.com/api/v1/webhooks \
  -H "x-api-key: cs_live_YOUR_KEY" \
  -H "content-type: application/json" \
  -d '{
    "url": "https://your-app.example/corpstacking-webhook",
    "events": ["purchase.detected", "holding.updated"],
    "description": "prod pipeline"
  }'

Response returns a secret field (prefix whsec_cs_). Store it now — subsequent GET /webhooks only shows the masked preview.

POST https://your-app.example/corpstacking-webhook
content-type: application/json
user-agent: CorpStacking-Webhooks/1.0
x-corpstacking-event: purchase.detected
x-corpstacking-event-id: 9f0c…e2a1
x-corpstacking-timestamp: 1745078400
x-corpstacking-signature: t=1745078400,v1=5a8b…c9d0

{
  "id": "9f0c…e2a1",
  "type": "purchase.detected",
  "created_at": "2026-04-19T14:00:00Z",
  "data": {
    "company": { "id": "uuid", "ticker": "MSTR" },
    "token_id": "bitcoin",
    "amount": 1250,
    "usd_amount": 82500000,
    "total_holdings_after": 214046,
    "purchase_date": "2026-04-19",
    "sec_accession": "0001104659-26-000...",
    "filing_url": "https://sec.gov/..."
  }
}

import { createHmac, timingSafeEqual } from 'crypto'

function verify(secret, rawBody, header) {
  const parts = Object.fromEntries(header.split(',').map(p => p.split('=', 2)))
  const t = parts.t, v1 = parts.v1
  if (!t || !v1) return false
  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex')
  const a = Buffer.from(v1, 'hex'), b = Buffer.from(expected, 'hex')
  return a.length === b.length && timingSafeEqual(a, b)
}

// Express handler — rawBody must be the unparsed request body bytes.
app.post('/corpstacking-webhook', express.raw({ type: '*/*' }), (req, res) => {
  const ok = verify(process.env.CORPSTACKING_SECRET, req.body.toString(), req.header('x-corpstacking-signature'))
  if (!ok) return res.sendStatus(400)
  const event = JSON.parse(req.body.toString())
  // ... dedupe on event.id, then process
  res.sendStatus(200)
})

Reject requests where the timestamp is more than 5 minutes old to prevent replay attacks. We retry on 5xx/network with exponential backoff up to 24h; 4xx is treated as permanent failure.

curl "https://www.corpstacking.com/api/v1/webhooks/events?subscription_id=SUB_ID&status=failed" \
  -H "x-api-key: cs_live_YOUR_KEY"

After 20 consecutive failures (~24h under the backoff curve), the subscription is auto-paused with paused_reason: too_many_failures. DELETE and recreate the subscription, or contact support to resume.