基于 Reality Radar 构建

curl -H "Authorization: Bearer rr_live_…" \
  https://realityradar-7h6.pages.dev/api/v1/public/alerts?limit=5

const res = await fetch('https://realityradar-7h6.pages.dev/api/v1/public/entities', {
  method: 'POST',
  headers: { Authorization: `Bearer ${process.env.RADAR_KEY}`, 'Content-Type': 'application/json' },
  body: JSON.stringify({ entityType: 'software_version', displayName: 'Node.js', modelOrVersion: '18.20.0',
    identifiers: { eolProduct: 'nodejs' }, relationship: 'used' }),
});
console.log(res.status, await res.json());

import os, requests
r = requests.get("https://realityradar-7h6.pages.dev/api/v1/public/events", params={"type": "product_recall", "limit": 20},
                 headers={"Authorization": f"Bearer {os.environ['RADAR_KEY']}"}, timeout=10)
r.raise_for_status()
for e in r.json()["items"]:
    print(e["firstSeenAt"], e["title"], e["sourceUrl"])

Authorization: Bearer rr_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

cursor = None
while True:
    page = requests.get(f"https://realityradar-7h6.pages.dev/api/v1/public/events", headers=H, params={"limit": 100, "cursor": cursor}).json()
    handle(page["items"])
    cursor = page["nextCursor"]
    if not cursor:
        break

{ "error": { "code": "insufficient_scope", "message": "This key lacks the \"write:entities\" scope" } }

POST /your/endpoint
Content-Type: application/json
User-Agent: RealityRadar-Webhook/1.0
X-Radar-Signature: t=1761112800,v1=5f2b…a91c,v1=03de…77b0

{"type":"alert.created","alert":{"impactLevel":"critical","matchType":"exact",…},"event":{…}}

import { createHmac, timingSafeEqual } from 'node:crypto';

// rawBody: the exact bytes you received (do not re-serialize JSON)
export function verifyRadar(header, rawBody, secret) {
  const parts = header.split(',').map((p) => p.split('='));
  const t = Number(parts.find(([k]) => k === 't')?.[1]);
  const sigs = parts.filter(([k]) => k === 'v1').map(([, v]) => v);
  if (!Number.isFinite(t) || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const mac = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex');
  return sigs.some((v) => v.length === mac.length && timingSafeEqual(Buffer.from(v), Buffer.from(mac)));
}

import hmac, hashlib, time

def verify_radar(header: str, raw_body: bytes, secret: str) -> bool:
    parts = [p.split("=", 1) for p in header.split(",")]
    t = next((int(v) for k, v in parts if k == "t"), None)
    sigs = [v for k, v in parts if k == "v1"]
    if t is None or abs(time.time() - t) > 300:
        return False
    mac = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(mac, s) for s in sigs)

func VerifyRadar(header string, rawBody []byte, secret string) bool {
	var t int64 = -1
	var sigs []string
	for _, p := range strings.Split(header, ",") {
		k, v, ok := strings.Cut(p, "=")
		if !ok { continue }
		if k == "t" { t, _ = strconv.ParseInt(v, 10, 64) }
		if k == "v1" { sigs = append(sigs, v) }
	}
	if t < 0 || math.Abs(float64(time.Now().Unix()-t)) > 300 { return false }
	m := hmac.New(sha256.New, []byte(secret))
	fmt.Fprintf(m, "%d.", t)
	m.Write(rawBody)
	want := hex.EncodeToString(m.Sum(nil))
	for _, s := range sigs {
		if hmac.Equal([]byte(want), []byte(s)) { return true }
	}
	return false
}

# Replay a delivery (fresh timestamp + signature)
curl -X POST -H "Authorization: Bearer rr_live_…" \
  https://realityradar-7h6.pages.dev/api/v1/public/webhooks/WEBHOOK_ID/deliveries/DELIVERY_ID/replay

curl -X POST -H "Authorization: Bearer rr_live_…" -H "Content-Type: application/json" \
  -d '{"entityType":"software_version","displayName":"lodash","modelOrVersion":"4.17.20","identifiers":{"purl":"pkg:npm/lodash"},"relationship":"used"}' \
  https://realityradar-7h6.pages.dev/api/v1/public/entities