Webhooks: real-time court case alerts in your own system

{
  "id": "evt_01HZY3K9G8X0000000000002",
  "type": "case.added",
  "createdAt": "2026-09-13T09:15:00.000Z",
  "accountId": "CPA0-Bq993yz3k4IVeK",
  "data": {
    "resourceType": "CASE",
    "resourceId": "CPWLC0-4d71b2",
    "deepLink": "/watchlist/case/CPWLC0-4d71b2",
    "caseReference": "DLHC01-004821-2026"
  }
}

const crypto = require("crypto");

function verifyCasePrimusSignature(rawBody, signatureHeader, signingSecret) {
  const match = /^t=(\d+),v1=([0-9a-f]+)$/.exec(signatureHeader ?? "");
  if (!match) throw new Error("Malformed X-CasePrimus-Signature header");
  const [, timestamp, signature] = match;

  const ageMs = Date.now() - Number(timestamp) * 1000;
  if (ageMs > 5 * 60 * 1000) throw new Error("Signature too old - possible replay");

  const expected = crypto
    .createHmac("sha256", signingSecret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");
  const expectedBuf = Buffer.from(expected);
  const signatureBuf = Buffer.from(signature);
  const valid = expectedBuf.length === signatureBuf.length
    && crypto.timingSafeEqual(expectedBuf, signatureBuf);
  if (!valid) throw new Error("Invalid signature");

  return JSON.parse(rawBody);
}

// Express example. It needs the RAW body, so this route must NOT use
// express.json() ahead of it.
app.post("/webhooks/caseprimus", express.raw({ type: "application/json" }), (req, res) => {
  const event = verifyCasePrimusSignature(
    req.body.toString("utf8"),
    req.header("X-CasePrimus-Signature"),
    process.env.CASEPRIMUS_WEBHOOK_SECRET
  );
  // handle event.type and event.data
  res.sendStatus(200);
});

import hmac
import hashlib
import json
import re
import time

def verify_caseprimus_signature(raw_body: bytes, signature_header: str, signing_secret: str) -> dict:
    match = re.match(r"^t=(\d+),v1=([0-9a-f]+)$", signature_header or "")
    if not match:
        raise ValueError("Malformed X-CasePrimus-Signature header")
    timestamp, signature = match.groups()

    age_seconds = time.time() - int(timestamp)
    if age_seconds > 5 * 60:
        raise ValueError("Signature too old - possible replay")

    message = f"{timestamp}.{raw_body.decode()}".encode()
    expected = hmac.new(signing_secret.encode(), message, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, signature):
        raise ValueError("Invalid signature")

    return json.loads(raw_body)