{
  "description": "Test vectors for verifying X-Up4-Signature of webhook subscription deliveries. Generated by go test ./internal/services -run WebhookVectors (UPDATE_WEBHOOK_VECTORS=1); do not edit.",
  "algorithm": "v1 = hex(HMAC-SHA256(key = the whole secret string, message = decimal t + \".\" + raw body)); header = t=<unix seconds>,v1=<v1>; reject when |now - t| > tolerance_seconds.",
  "tolerance_seconds": 300,
  "secret": "whsec_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
  "timestamp": 1792832400,
  "body": "{\"payload_version\":2,\"type\":\"monitor.status_changed\",\"app_url\":\"https://app.upfour.io/monitors/11111111-1111-4111-8111-111111111111\",\"id\":\"9d1b2c3e-4f5a-4b6c-8d7e-0a1b2c3d4e5f\",\"created_at\":\"2026-10-24T09:00:00Z\",\"data\":{\"metadata\":{\"customer_no\":\"K-4711\"},\"monitor_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"DOWN\"}}",
  "signature": "cae96efbd3c352c9196dd1240de2d10cead4bded7ab892f198d44a619261e60b",
  "header": "t=1792832400,v1=cae96efbd3c352c9196dd1240de2d10cead4bded7ab892f198d44a619261e60b",
  "cases": [
    {
      "name": "valid",
      "description": "The header as up4 sends it, checked at the moment it was signed.",
      "secret": "whsec_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "header": "t=1792832400,v1=cae96efbd3c352c9196dd1240de2d10cead4bded7ab892f198d44a619261e60b",
      "body": "{\"payload_version\":2,\"type\":\"monitor.status_changed\",\"app_url\":\"https://app.upfour.io/monitors/11111111-1111-4111-8111-111111111111\",\"id\":\"9d1b2c3e-4f5a-4b6c-8d7e-0a1b2c3d4e5f\",\"created_at\":\"2026-10-24T09:00:00Z\",\"data\":{\"metadata\":{\"customer_no\":\"K-4711\"},\"monitor_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"DOWN\"}}",
      "now": 1792832400,
      "valid": true
    },
    {
      "name": "valid_utf8_body",
      "description": "A body with non-ASCII characters: the HMAC covers the bytes, not characters.",
      "secret": "whsec_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "header": "t=1792832400,v1=c77d1d843a937dffc25ba3c3f054b94309875aaed6c81ee4264e3b8d29f83e86",
      "body": "{\"payload_version\":2,\"type\":\"heartbeat.missed\",\"app_url\":\"https://app.upfour.io/heartbeats/22222222-2222-4222-8222-222222222222\",\"id\":\"9d1b2c3e-4f5a-4b6c-8d7e-0a1b2c3d4e5f\",\"created_at\":\"2026-10-24T09:00:00Z\",\"data\":{\"heartbeat_id\":\"22222222-2222-4222-8222-222222222222\",\"name\":\"Nächtliches Backup für Müller \\u0026 Söhne ✓\",\"status\":\"down\"}}",
      "now": 1792832400,
      "valid": true
    },
    {
      "name": "valid_299_seconds_late",
      "description": "Still inside the five-minute window.",
      "secret": "whsec_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "header": "t=1792832400,v1=cae96efbd3c352c9196dd1240de2d10cead4bded7ab892f198d44a619261e60b",
      "body": "{\"payload_version\":2,\"type\":\"monitor.status_changed\",\"app_url\":\"https://app.upfour.io/monitors/11111111-1111-4111-8111-111111111111\",\"id\":\"9d1b2c3e-4f5a-4b6c-8d7e-0a1b2c3d4e5f\",\"created_at\":\"2026-10-24T09:00:00Z\",\"data\":{\"metadata\":{\"customer_no\":\"K-4711\"},\"monitor_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"DOWN\"}}",
      "now": 1792832699,
      "valid": true
    },
    {
      "name": "valid_299_seconds_early",
      "description": "The receiver's clock runs behind: still inside the window.",
      "secret": "whsec_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "header": "t=1792832400,v1=cae96efbd3c352c9196dd1240de2d10cead4bded7ab892f198d44a619261e60b",
      "body": "{\"payload_version\":2,\"type\":\"monitor.status_changed\",\"app_url\":\"https://app.upfour.io/monitors/11111111-1111-4111-8111-111111111111\",\"id\":\"9d1b2c3e-4f5a-4b6c-8d7e-0a1b2c3d4e5f\",\"created_at\":\"2026-10-24T09:00:00Z\",\"data\":{\"metadata\":{\"customer_no\":\"K-4711\"},\"monitor_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"DOWN\"}}",
      "now": 1792832101,
      "valid": true
    },
    {
      "name": "valid_second_v1_matches",
      "description": "Several v1 values: one of them matches, so the header is valid. up4 sends one today; a receiver that accepts any match survives a change.",
      "secret": "whsec_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "header": "t=1792832400,v1=693fcf3b6f0792bbfba2c7d0a5f90f2c20531480e4df879470bf3bd35878ef2a,v1=cae96efbd3c352c9196dd1240de2d10cead4bded7ab892f198d44a619261e60b",
      "body": "{\"payload_version\":2,\"type\":\"monitor.status_changed\",\"app_url\":\"https://app.upfour.io/monitors/11111111-1111-4111-8111-111111111111\",\"id\":\"9d1b2c3e-4f5a-4b6c-8d7e-0a1b2c3d4e5f\",\"created_at\":\"2026-10-24T09:00:00Z\",\"data\":{\"metadata\":{\"customer_no\":\"K-4711\"},\"monitor_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"DOWN\"}}",
      "now": 1792832400,
      "valid": true
    },
    {
      "name": "invalid_wrong_secret",
      "description": "Signed with another secret.",
      "secret": "whsec_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "header": "t=1792832400,v1=693fcf3b6f0792bbfba2c7d0a5f90f2c20531480e4df879470bf3bd35878ef2a",
      "body": "{\"payload_version\":2,\"type\":\"monitor.status_changed\",\"app_url\":\"https://app.upfour.io/monitors/11111111-1111-4111-8111-111111111111\",\"id\":\"9d1b2c3e-4f5a-4b6c-8d7e-0a1b2c3d4e5f\",\"created_at\":\"2026-10-24T09:00:00Z\",\"data\":{\"metadata\":{\"customer_no\":\"K-4711\"},\"monitor_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"DOWN\"}}",
      "now": 1792832400,
      "valid": false
    },
    {
      "name": "invalid_secret_without_prefix",
      "description": "The key is the whole secret including whsec_; the hex part alone is another key.",
      "secret": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "header": "t=1792832400,v1=cae96efbd3c352c9196dd1240de2d10cead4bded7ab892f198d44a619261e60b",
      "body": "{\"payload_version\":2,\"type\":\"monitor.status_changed\",\"app_url\":\"https://app.upfour.io/monitors/11111111-1111-4111-8111-111111111111\",\"id\":\"9d1b2c3e-4f5a-4b6c-8d7e-0a1b2c3d4e5f\",\"created_at\":\"2026-10-24T09:00:00Z\",\"data\":{\"metadata\":{\"customer_no\":\"K-4711\"},\"monitor_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"DOWN\"}}",
      "now": 1792832400,
      "valid": false
    },
    {
      "name": "invalid_body_changed_one_bit",
      "description": "One bit of the body changed after signing.",
      "secret": "whsec_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "header": "t=1792832400,v1=cae96efbd3c352c9196dd1240de2d10cead4bded7ab892f198d44a619261e60b",
      "body": "{\"payload_version\":2,\"type\":\"monitor.status_changed\",\"app_url\":\"https://app.upfour.io/monitors/11111111-1111-4111-8111-111111111111\",\"id\":\"9d1b2c3e-4f5a-4b6c-8d7e,0a1b2c3d4e5f\",\"created_at\":\"2026-10-24T09:00:00Z\",\"data\":{\"metadata\":{\"customer_no\":\"K-4711\"},\"monitor_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"DOWN\"}}",
      "now": 1792832400,
      "valid": false
    },
    {
      "name": "invalid_body_reserialised",
      "description": "The same JSON with other whitespace: verify the raw bytes you received, not a re-serialised copy.",
      "secret": "whsec_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "header": "t=1792832400,v1=cae96efbd3c352c9196dd1240de2d10cead4bded7ab892f198d44a619261e60b",
      "body": "{\n  \"payload_version\": 2,\n  \"type\": \"monitor.status_changed\",\n  \"app_url\": \"https://app.upfour.io/monitors/11111111-1111-4111-8111-111111111111\",\n  \"id\": \"9d1b2c3e-4f5a-4b6c-8d7e-0a1b2c3d4e5f\",\n  \"created_at\": \"2026-10-24T09:00:00Z\",\n  \"data\": {\n    \"metadata\": {\n      \"customer_no\": \"K-4711\"\n    },\n    \"monitor_id\": \"11111111-1111-4111-8111-111111111111\",\n    \"state\": \"DOWN\"\n  }\n}",
      "now": 1792832400,
      "valid": false
    },
    {
      "name": "invalid_timestamp_too_old",
      "description": "301 seconds old: outside the five-minute window.",
      "secret": "whsec_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "header": "t=1792832400,v1=cae96efbd3c352c9196dd1240de2d10cead4bded7ab892f198d44a619261e60b",
      "body": "{\"payload_version\":2,\"type\":\"monitor.status_changed\",\"app_url\":\"https://app.upfour.io/monitors/11111111-1111-4111-8111-111111111111\",\"id\":\"9d1b2c3e-4f5a-4b6c-8d7e-0a1b2c3d4e5f\",\"created_at\":\"2026-10-24T09:00:00Z\",\"data\":{\"metadata\":{\"customer_no\":\"K-4711\"},\"monitor_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"DOWN\"}}",
      "now": 1792832701,
      "valid": false
    },
    {
      "name": "invalid_timestamp_in_the_future",
      "description": "301 seconds ahead of the receiver's clock.",
      "secret": "whsec_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "header": "t=1792832400,v1=cae96efbd3c352c9196dd1240de2d10cead4bded7ab892f198d44a619261e60b",
      "body": "{\"payload_version\":2,\"type\":\"monitor.status_changed\",\"app_url\":\"https://app.upfour.io/monitors/11111111-1111-4111-8111-111111111111\",\"id\":\"9d1b2c3e-4f5a-4b6c-8d7e-0a1b2c3d4e5f\",\"created_at\":\"2026-10-24T09:00:00Z\",\"data\":{\"metadata\":{\"customer_no\":\"K-4711\"},\"monitor_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"DOWN\"}}",
      "now": 1792832099,
      "valid": false
    },
    {
      "name": "invalid_timestamp_replaced",
      "description": "t replaced by a fresh time, v1 left alone: the signature covers t.",
      "secret": "whsec_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "header": "t=1792836000,v1=cae96efbd3c352c9196dd1240de2d10cead4bded7ab892f198d44a619261e60b",
      "body": "{\"payload_version\":2,\"type\":\"monitor.status_changed\",\"app_url\":\"https://app.upfour.io/monitors/11111111-1111-4111-8111-111111111111\",\"id\":\"9d1b2c3e-4f5a-4b6c-8d7e-0a1b2c3d4e5f\",\"created_at\":\"2026-10-24T09:00:00Z\",\"data\":{\"metadata\":{\"customer_no\":\"K-4711\"},\"monitor_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"DOWN\"}}",
      "now": 1792836000,
      "valid": false
    },
    {
      "name": "invalid_two_v1_none_matches",
      "description": "Several v1 values and none of them matches.",
      "secret": "whsec_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "header": "t=1792832400,v1=693fcf3b6f0792bbfba2c7d0a5f90f2c20531480e4df879470bf3bd35878ef2a,v1=0000000000000000000000000000000000000000000000000000000000000000",
      "body": "{\"payload_version\":2,\"type\":\"monitor.status_changed\",\"app_url\":\"https://app.upfour.io/monitors/11111111-1111-4111-8111-111111111111\",\"id\":\"9d1b2c3e-4f5a-4b6c-8d7e-0a1b2c3d4e5f\",\"created_at\":\"2026-10-24T09:00:00Z\",\"data\":{\"metadata\":{\"customer_no\":\"K-4711\"},\"monitor_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"DOWN\"}}",
      "now": 1792832400,
      "valid": false
    },
    {
      "name": "invalid_no_v1",
      "description": "A header without v1.",
      "secret": "whsec_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "header": "t=1792832400",
      "body": "{\"payload_version\":2,\"type\":\"monitor.status_changed\",\"app_url\":\"https://app.upfour.io/monitors/11111111-1111-4111-8111-111111111111\",\"id\":\"9d1b2c3e-4f5a-4b6c-8d7e-0a1b2c3d4e5f\",\"created_at\":\"2026-10-24T09:00:00Z\",\"data\":{\"metadata\":{\"customer_no\":\"K-4711\"},\"monitor_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"DOWN\"}}",
      "now": 1792832400,
      "valid": false
    },
    {
      "name": "invalid_not_hex",
      "description": "v1 is not hexadecimal.",
      "secret": "whsec_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "header": "t=1792832400,v1=zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz",
      "body": "{\"payload_version\":2,\"type\":\"monitor.status_changed\",\"app_url\":\"https://app.upfour.io/monitors/11111111-1111-4111-8111-111111111111\",\"id\":\"9d1b2c3e-4f5a-4b6c-8d7e-0a1b2c3d4e5f\",\"created_at\":\"2026-10-24T09:00:00Z\",\"data\":{\"metadata\":{\"customer_no\":\"K-4711\"},\"monitor_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"DOWN\"}}",
      "now": 1792832400,
      "valid": false
    },
    {
      "name": "invalid_empty_header",
      "description": "No signature header at all.",
      "secret": "whsec_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "header": "",
      "body": "{\"payload_version\":2,\"type\":\"monitor.status_changed\",\"app_url\":\"https://app.upfour.io/monitors/11111111-1111-4111-8111-111111111111\",\"id\":\"9d1b2c3e-4f5a-4b6c-8d7e-0a1b2c3d4e5f\",\"created_at\":\"2026-10-24T09:00:00Z\",\"data\":{\"metadata\":{\"customer_no\":\"K-4711\"},\"monitor_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"DOWN\"}}",
      "now": 1792832400,
      "valid": false
    },
    {
      "name": "invalid_garbage_header",
      "description": "A header that is not t=,v1= pairs.",
      "secret": "whsec_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "header": "sha256=cae96efbd3c352c9196dd1240de2d10cead4bded7ab892f198d44a619261e60b",
      "body": "{\"payload_version\":2,\"type\":\"monitor.status_changed\",\"app_url\":\"https://app.upfour.io/monitors/11111111-1111-4111-8111-111111111111\",\"id\":\"9d1b2c3e-4f5a-4b6c-8d7e-0a1b2c3d4e5f\",\"created_at\":\"2026-10-24T09:00:00Z\",\"data\":{\"metadata\":{\"customer_no\":\"K-4711\"},\"monitor_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"DOWN\"}}",
      "now": 1792832400,
      "valid": false
    }
  ]
}