hookbase 3.1.0__tar.gz → 3.2.0__tar.gz

{hookbase-3.1.0 → hookbase-3.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: hookbase
-Version: 3.1.0
+Version: 3.2.0
 Summary: Official Python SDK for the Hookbase webhook management platform
 Project-URL: Homepage, https://hookbase.app
 Project-URL: Documentation, https://www.hookbase.app/docs/send/sdk
@@ -98,7 +98,26 @@ client.sources.create({"name": "GitHub", "slug": "github", "provider": "github"}
 client.sources.get("src_id")
 client.sources.update("src_id", {"name": "Updated"})
 client.sources.delete("src_id")
-client.sources.rotate_secret("src_id")
+client.sources.rotate_secret("src_id")  # 400 for vendor-issued/public-key/built-in secrets
+client.sources.reveal_secret("src_id")
+
+# A provider that verifies with no secret: signing_secret comes back None
+wise = client.sources.create({"name": "Wise", "slug": "wise", "provider": "wise"})
+assert wise.verifies_without_secret and wise.signing_secret is None
+
+# WhatsApp (Meta) sources also carry a verify token
+wa = client.sources.create({"name": "WhatsApp", "slug": "whatsapp", "provider": "whatsapp"})
+print(wa.verify_token)
+client.sources.rotate_verify_token(wa.id)
+
+# Notion parks its verification token until you adopt it
+pending = client.sources.get_pending_verification("notion")
+client.sources.adopt_pending_verification("notion")
+
+# Provider catalog: which secret each provider needs (public, no auth needed)
+for p in client.providers.list(category="payments").providers:
+    print(p.hookbase_provider, p.signature_verification and p.signature_verification.secret_source)
+client.providers.get("stripe").signature_verification
 
 # Destinations
 client.destinations.list()
@@ -111,7 +130,7 @@ client.routes.get_circuit_status("route_id")
 client.routes.reset_circuit("route_id")
 
 # Events & Deliveries
-client.events.list(source_id="src_id", from_date="2024-01-01")
+client.events.list(source_id="src_id", from_date="2024-01-01")  # id or slug; unknown -> 404
 client.events.get("evt_id")  # Includes payload and deliveries
 client.deliveries.replay("del_id")
 client.deliveries.bulk_replay(["del_1", "del_2"])
@@ -252,11 +271,14 @@ All responses are typed Pydantic models with camelCase alias support:
 from hookbase.models import Source, CreateSourceParams
 
 # Use Pydantic models for type safety
-params = CreateSourceParams(name="GitHub", provider="github")
+params = CreateSourceParams(name="GitHub", slug="github", provider="github")
 source = client.sources.create(params)
 
 # Or use plain dicts
-source = client.sources.create({"name": "GitHub", "provider": "github"})
+source = client.sources.create({"name": "GitHub", "slug": "github", "provider": "github"})
+
+# `provider` is any string (hookbase.models.KNOWN_SOURCE_PROVIDERS lists today's values), so a
+# source with a provider newer than this package still parses.
 ```
 
 ## Development

{hookbase-3.1.0 → hookbase-3.2.0}/README.md

@@ -63,7 +63,26 @@ client.sources.create({"name": "GitHub", "slug": "github", "provider": "github"}
 client.sources.get("src_id")
 client.sources.update("src_id", {"name": "Updated"})
 client.sources.delete("src_id")
-client.sources.rotate_secret("src_id")
+client.sources.rotate_secret("src_id")  # 400 for vendor-issued/public-key/built-in secrets
+client.sources.reveal_secret("src_id")
+
+# A provider that verifies with no secret: signing_secret comes back None
+wise = client.sources.create({"name": "Wise", "slug": "wise", "provider": "wise"})
+assert wise.verifies_without_secret and wise.signing_secret is None
+
+# WhatsApp (Meta) sources also carry a verify token
+wa = client.sources.create({"name": "WhatsApp", "slug": "whatsapp", "provider": "whatsapp"})
+print(wa.verify_token)
+client.sources.rotate_verify_token(wa.id)
+
+# Notion parks its verification token until you adopt it
+pending = client.sources.get_pending_verification("notion")
+client.sources.adopt_pending_verification("notion")
+
+# Provider catalog: which secret each provider needs (public, no auth needed)
+for p in client.providers.list(category="payments").providers:
+    print(p.hookbase_provider, p.signature_verification and p.signature_verification.secret_source)
+client.providers.get("stripe").signature_verification
 
 # Destinations
 client.destinations.list()
@@ -76,7 +95,7 @@ client.routes.get_circuit_status("route_id")
 client.routes.reset_circuit("route_id")
 
 # Events & Deliveries
-client.events.list(source_id="src_id", from_date="2024-01-01")
+client.events.list(source_id="src_id", from_date="2024-01-01")  # id or slug; unknown -> 404
 client.events.get("evt_id")  # Includes payload and deliveries
 client.deliveries.replay("del_id")
 client.deliveries.bulk_replay(["del_1", "del_2"])
@@ -217,11 +236,14 @@ All responses are typed Pydantic models with camelCase alias support:
 from hookbase.models import Source, CreateSourceParams
 
 # Use Pydantic models for type safety
-params = CreateSourceParams(name="GitHub", provider="github")
+params = CreateSourceParams(name="GitHub", slug="github", provider="github")
 source = client.sources.create(params)
 
 # Or use plain dicts
-source = client.sources.create({"name": "GitHub", "provider": "github"})
+source = client.sources.create({"name": "GitHub", "slug": "github", "provider": "github"})
+
+# `provider` is any string (hookbase.models.KNOWN_SOURCE_PROVIDERS lists today's values), so a
+# source with a provider newer than this package still parses.
 ```
 
 ## Development

hookbase-3.2.0/src/hookbase/_version.py

@@ -0,0 +1 @@
+__version__ = "3.2.0"

{hookbase-3.1.0 → hookbase-3.2.0}/src/hookbase/client.py

@@ -26,6 +26,7 @@ from .resources import (
     AsyncMessages,
     AsyncOrganizations,
     AsyncPortalTokens,
+    AsyncProviders,
     AsyncRoutes,
     AsyncSchemas,
     AsyncSources,
@@ -43,6 +44,7 @@ from .resources import (
     Messages,
     Organizations,
     PortalTokens,
+    Providers,
     Routes,
     Schemas,
     Sources,
@@ -118,6 +120,8 @@ class Hookbase:
     transforms: Transforms
     filters: Filters
     schemas: Schemas
+    #: The public provider catalog (what each provider signs with, which secret it needs).
+    providers: Providers
 
     # Outbound
     outbound: _OutboundNamespace
@@ -160,6 +164,7 @@ class Hookbase:
         self.transforms = Transforms(self._transport)
         self.filters = Filters(self._transport)
         self.schemas = Schemas(self._transport)
+        self.providers = Providers(self._transport)
 
         # Outbound namespace
         self.outbound = _OutboundNamespace(self._transport)
@@ -210,6 +215,8 @@ class AsyncHookbase:
     transforms: AsyncTransforms
     filters: AsyncFilters
     schemas: AsyncSchemas
+    #: The public provider catalog (what each provider signs with, which secret it needs).
+    providers: AsyncProviders
 
     # Outbound
     outbound: _AsyncOutboundNamespace
@@ -252,6 +259,7 @@ class AsyncHookbase:
         self.transforms = AsyncTransforms(self._transport)
         self.filters = AsyncFilters(self._transport)
         self.schemas = AsyncSchemas(self._transport)
+        self.providers = AsyncProviders(self._transport)
 
         # Outbound namespace
         self.outbound = _AsyncOutboundNamespace(self._transport)

{hookbase-3.1.0 → hookbase-3.2.0}/src/hookbase/models/__init__.py

@@ -1,6 +1,16 @@
 from .analytics import AnalyticsTimeline, DashboardData
 from .api_keys import ApiKey, ApiKeyWithSecret, CreateApiKeyParams
 from .applications import Application, CreateApplicationParams, UpdateApplicationParams
+from .catalog import (
+    CatalogProvider,
+    CatalogProviderDetail,
+    ProviderCatalogList,
+    ProviderEvents,
+    ProviderEventType,
+    ProviderSignatureVerification,
+    ProviderSignatureVerificationSummary,
+    ProviderVerifyTokenInfo,
+)
 from .common import BulkDeleteResult, ImportResult, ImportResultItem
 from .cron_jobs import (
     CreateCronGroupParams,
@@ -89,9 +99,13 @@ from .routes import (
 )
 from .schemas import CreateSchemaParams, Schema, SchemaValidationResult, UpdateSchemaParams
 from .sources import (
+    CLEARABLE_SOURCE_FIELDS,
+    KNOWN_SOURCE_PROVIDERS,
+    ClearableSourceField,
     CreateSourceParams,
     DedupStrategy,
     IpFilterMode,
+    PendingVerification,
     Source,
     SourceProvider,
     SourceWithSecret,
@@ -119,6 +133,15 @@ __all__ = [
     "Application",
     "CreateApplicationParams",
     "UpdateApplicationParams",
+    # Catalog
+    "CatalogProvider",
+    "CatalogProviderDetail",
+    "ProviderCatalogList",
+    "ProviderEventType",
+    "ProviderEvents",
+    "ProviderSignatureVerification",
+    "ProviderSignatureVerificationSummary",
+    "ProviderVerifyTokenInfo",
     # Common
     "BulkDeleteResult",
     "ImportResult",
@@ -211,9 +234,13 @@ __all__ = [
     "SchemaValidationResult",
     "UpdateSchemaParams",
     # Sources
+    "CLEARABLE_SOURCE_FIELDS",
+    "KNOWN_SOURCE_PROVIDERS",
+    "ClearableSourceField",
     "CreateSourceParams",
     "DedupStrategy",
     "IpFilterMode",
+    "PendingVerification",
     "Source",
     "SourceProvider",
     "SourceWithSecret",

hookbase-3.2.0/src/hookbase/models/catalog.py

@@ -0,0 +1,120 @@
+"""The public provider catalog: GET /api/catalog/providers (no authentication needed).
+
+Every enumerated value here (category, kind, secret_source, secret_format) is a plain string
+rather than a Literal, for the reason ``SourceProvider`` is: the catalog grows server-side, and a
+value this package has not heard of must not make the whole response fail to parse.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from pydantic import field_validator
+
+from ._base import HookbaseModel
+
+
+class ProviderEventType(HookbaseModel):
+    type: str
+    description: str = ""
+
+
+class ProviderVerifyTokenInfo(HookbaseModel):
+    """Meta's second, Hookbase-generated credential (see SourceWithSecret.verify_token)."""
+
+    label: str
+    instruction: str = ""
+
+
+class ProviderSignatureVerificationSummary(HookbaseModel):
+    """The secret fields a create flow needs, as the catalog list carries them.
+
+    ``secret_source`` says who produces the credential: "provider" (the vendor issues it; paste
+    it as signing_secret), "operator" (Hookbase generates it when omitted; paste it into the
+    vendor), "public_key" (paste the vendor's public key), "built_in" (nothing to enter; events
+    are still verified) or "none" (the vendor does not sign).
+    """
+
+    supported: bool = False
+    #: The scheme kind: "hmac", "shared_secret", "bespoke" or "asymmetric". None when no scheme.
+    kind: str | None = None
+    secret_source: str | None = None
+    secret_label: str | None = None
+    secret_placeholder: str | None = None
+    #: The vendor issues the secret only after the source's URL is registered with it.
+    secret_after_registration: bool = False
+
+
+class ProviderSignatureVerification(ProviderSignatureVerificationSummary):
+    """The full block from the provider detail call."""
+
+    algorithm: str | None = None
+    header_name: str | None = None
+    secret_location_hint: str | None = None
+    #: One sentence on where the value comes from or goes, in the vendor's own UI wording.
+    secret_instruction: str | None = None
+    #: "whsec" or "basic_auth" when the value has a required shape.
+    secret_format: str | None = None
+    #: Present for Meta providers, which also use a verify token.
+    verify_token: ProviderVerifyTokenInfo | None = None
+
+
+class CatalogProvider(HookbaseModel):
+    """A provider as the catalog list returns it.
+
+    ``id`` is the catalog's id; ``hookbase_provider`` is the value to use as a source's
+    ``provider``. They differ for some entries (catalog "mollie-nextgen" is provider "mollie",
+    and several catalog entries map to "custom").
+    """
+
+    id: str
+    name: str
+    category: str = ""
+    description: str = ""
+    icon: str | None = None
+    event_type_count: int = 0
+    hookbase_provider: str = ""
+    has_signature_verification: bool = False
+    has_ip_ranges: bool = False
+    #: None when the provider has no verification block, and also from API versions that
+    #: predate this summary on list items: fall back to client.providers.get(id) for it.
+    signature_verification: ProviderSignatureVerificationSummary | None = None
+
+
+class ProviderCatalogList(HookbaseModel):
+    providers: list[CatalogProvider] = []
+    categories: list[str] = []
+    total: int = 0
+
+
+class CatalogProviderDetail(HookbaseModel):
+    """One provider in full, from GET /api/catalog/providers/:id."""
+
+    id: str
+    name: str
+    category: str = ""
+    description: str = ""
+    website: str | None = None
+    docs_url: str | None = None
+    icon: str | None = None
+    hookbase_provider: str = ""
+    signature_verification: ProviderSignatureVerification | None = None
+    event_types: list[ProviderEventType] = []
+    #: Example payloads keyed by event type.
+    sample_payloads: dict[str, Any] = {}
+    ip_ranges: list[str] | None = None
+    setup_guide: list[str] = []
+
+    @field_validator("event_types", "setup_guide", mode="before")
+    @classmethod
+    def _none_to_list(cls, v: Any) -> Any:
+        return [] if v is None else v
+
+
+class ProviderEvents(HookbaseModel):
+    """GET /api/catalog/providers/:id/events."""
+
+    provider_id: str
+    provider_name: str = ""
+    event_types: list[ProviderEventType] = []
+    sample_payloads: dict[str, Any] = {}

hookbase-3.2.0/src/hookbase/models/sources.py

@@ -0,0 +1,283 @@
+from __future__ import annotations
+
+import json
+from typing import Any, Literal
+
+from pydantic import field_validator
+
+from . import _wire
+from ._base import HookbaseModel
+
+# Providers the API accepts for a source today.
+#
+# Mirrors SUPPORTED_SIGNATURE_PROVIDERS in the API (api/src/utils/signature-schemes.ts): 71
+# signature schemes plus the aliases svix, clerk, resend, render, etsy and stytch (all of
+# standard-webhooks) and generic (of custom). Regenerate with
+# `npx tsx scripts/print-source-enums.ts` in the api package.
+#
+# This is a list of suggestions, not a constraint. `provider` is typed as a plain string on every
+# model, request and response alike, because the API adds providers faster than this package
+# ships: when it was a Literal, a single source created with a newer provider (wise, whatsapp...)
+# made list(), get() and create() raise a ValidationError for the whole call. The API validates
+# the value on create and update and answers an unknown one with a 400 naming it.
+KNOWN_SOURCE_PROVIDERS: tuple[str, ...] = (
+    "adyen", "airtable", "asana", "auth0", "aws-sns", "bigcommerce", "bitbucket", "braintree",
+    "calendly", "chargebee", "circleci", "clerk", "clickup", "cloudflare", "coinbase-commerce",
+    "custom", "datadog", "discord", "docusign", "etsy", "freshdesk", "generic", "github",
+    "gitlab", "gitlab-signing-token", "gocardless", "grafana", "grafana-hmac",
+    "grafana-hmac-timestamped", "heroku", "hubspot", "intercom", "jira", "klaviyo",
+    "launchdarkly", "lemonsqueezy", "linear", "mailchimp", "mailgun", "mollie", "netlify",
+    "newrelic", "notion", "okta", "paddle", "pagerduty", "paypal", "pipedrive", "postmark",
+    "railway", "razorpay", "render", "resend", "segment", "sendgrid", "sentry", "shopify",
+    "slack", "square", "standard-webhooks", "stripe", "stytch", "supabase",
+    "supabase-auth-hooks", "svix", "telegram", "terraform-cloud", "trello", "twilio",
+    "typeform", "vercel", "whatsapp", "wise", "wise-sandbox", "woocommerce", "workos",
+    "zendesk", "zoom",
+)
+#: A source provider id. Any string: see KNOWN_SOURCE_PROVIDERS for the values accepted today.
+SourceProvider = str
+
+# Corrected in 2026-09: "header" and "event_id" were never accepted, and the three values the
+# API actually defaults to and documents were missing. "auto" is the default.
+DedupStrategy = Literal["auto", "provider_id", "payload_hash", "idempotency_key", "none"]
+IpFilterMode = Literal["none", "allowlist", "denylist", "both"]
+# HTTP verbs an ingest endpoint can be restricted to. OPTIONS is excluded: CORS preflight is
+# answered before ingest runs, so it is never gateable.
+IngestMethod = Literal["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"]
+
+# The settings PATCH /api/sources/:id accepts an explicit null for (`.nullable()` in
+# updateSourceSchema). Naming one in `UpdateSourceParams.clear` sends that null. Null signingSecret
+# removes the secret; null verifyToken generates a fresh one. `clear` also takes snake_case.
+CLEARABLE_SOURCE_FIELDS: tuple[str, ...] = (
+    "description",
+    "provider",
+    "signingSecret",
+    "verifyToken",
+    "rateLimitPerMinute",
+    "ipAllowlist",
+    "ipDenylist",
+    "encryptFields",
+    "maskFields",
+    "dedupStrategy",
+    "dedupWindowHours",
+    "dedupCustomHeader",
+    "allowedMethods",
+)
+ClearableSourceField = Literal[
+    "description", "provider", "signingSecret", "verifyToken", "rateLimitPerMinute",
+    "ipAllowlist", "ipDenylist", "encryptFields", "maskFields", "dedupStrategy",
+    "dedupWindowHours", "dedupCustomHeader", "allowedMethods",
+    "signing_secret", "verify_token", "rate_limit_per_minute", "ip_allowlist", "ip_denylist",
+    "encrypt_fields", "mask_fields", "dedup_strategy", "dedup_window_hours",
+    "dedup_custom_header", "allowed_methods",
+]
+
+
+class Source(HookbaseModel):
+    """A source as the API returns it.
+
+    The signing secret is not included. Responses carry ``has_signing_secret`` and the last four
+    characters; the full value comes back exactly twice, from :meth:`Sources.create` (which
+    returns a :class:`SourceWithSecret`) and from :meth:`Sources.reveal_secret`.
+
+    ``has_signing_secret`` being False is not always a problem. Check the two flags beside it:
+    ``verifies_without_secret`` (the provider signs with a key Hookbase already holds, as Wise
+    and AWS SNS do, so events are verified with nothing set) and ``awaiting_signing_secret``
+    (the vendor issues the secret only after the URL is registered with it, as Asana and Notion
+    do, and it has not been set yet).
+    """
+
+    id: str
+    organization_id: str | None = None
+    name: str
+    slug: str
+    #: Any string; see KNOWN_SOURCE_PROVIDERS. Never validated client-side.
+    provider: SourceProvider | None = None
+    description: str | None = None
+    #: Whether a signing secret is set. The secret itself is not returned here.
+    has_signing_secret: bool = False
+    #: Last four characters of the signing secret, prefixed with "...", or None if unset.
+    signing_secret_last4: str | None = None
+    #: The provider verifies with a key Hookbase already holds (wise, wise-sandbox, aws-sns), so
+    #: there is no secret to set and has_signing_secret stays False on a fully verified source.
+    verifies_without_secret: bool = False
+    #: The vendor issues the secret only once this source's URL is registered with it (asana,
+    #: notion) and it has not been set yet. Events are not verified until it is. For Notion, see
+    #: Sources.get_pending_verification.
+    awaiting_signing_secret: bool = False
+    #: Reject events whose signature fails verification. Defaults to False, in which case a
+    #: failing event is flagged with signature_valid=False and delivered anyway.
+    reject_invalid_signatures: bool = False
+    rate_limit_per_minute: int | None = None
+    is_active: bool = True
+    custom_domain_id: str | None = None
+    ip_filter_mode: IpFilterMode = "none"
+    ip_allowlist: list[str] = []
+    ip_denylist: list[str] = []
+    #: JSONPath expressions whose values are encrypted at rest.
+    encrypt_fields: list[str] = []
+    #: JSONPath expressions whose values are masked in stored payloads.
+    mask_fields: list[str] = []
+    dedup_enabled: bool = False
+    dedup_strategy: DedupStrategy = "auto"
+    dedup_window_hours: int = 24
+    dedup_custom_header: str | None = None
+    transient_mode: bool = False
+    #: HTTP verbs the ingest endpoint accepts. Empty list means any method.
+    allowed_methods: list[str] = []
+    event_count: int = 0
+    route_count: int = 0
+    #: Returned by get() and create(). Not included in list() responses.
+    ingest_url: str | None = None
+    created_at: str = ""
+    updated_at: str = ""
+
+    @field_validator(
+        "is_active",
+        "reject_invalid_signatures",
+        "has_signing_secret",
+        "verifies_without_secret",
+        "awaiting_signing_secret",
+        "dedup_enabled",
+        "transient_mode",
+        mode="before",
+    )
+    @classmethod
+    def parse_bool_from_int(cls, v: Any) -> Any:
+        if isinstance(v, int):
+            return bool(v)
+        return v
+
+    @field_validator(
+        "ip_allowlist", "ip_denylist", "encrypt_fields", "mask_fields", mode="before"
+    )
+    @classmethod
+    def parse_json_list(cls, v: Any) -> Any:
+        if v is None:
+            return []
+        if isinstance(v, str):
+            try:
+                parsed = json.loads(v)
+                return parsed if isinstance(parsed, list) else []
+            except (json.JSONDecodeError, ValueError):
+                return []
+        return v
+
+    @field_validator("allowed_methods", mode="before")
+    @classmethod
+    def parse_allowed_methods(cls, v: Any) -> Any:
+        """Coerce null/JSON-string forms to a list; both mean "any method" when empty."""
+        if v is None:
+            return []
+        if isinstance(v, str):
+            try:
+                parsed = json.loads(v)
+                return parsed if isinstance(parsed, list) else []
+            except (json.JSONDecodeError, ValueError):
+                return []
+        return v
+
+
+class SourceWithSecret(Source):
+    """What create() returns: a source plus the one look at its signing secret you get."""
+
+    #: The signing secret, in full, this once. None when the source has none to show: the
+    #: provider verifies without one (verifies_without_secret), the vendor issues it after
+    #: registration (awaiting_signing_secret), or the provider does not sign.
+    signing_secret: str | None = None
+    #: Meta providers (whatsapp) only: the verify token to paste into Meta's webhook setup, in
+    #: full, this once. Sources.verify_token reveals it later.
+    verify_token: str | None = None
+
+
+class PendingVerification(HookbaseModel):
+    """A verification token a vendor delivered to the ingest URL during registration (Notion).
+
+    The request that carried it was unauthenticated, so it is held rather than adopted: paste
+    ``token`` into the vendor's verify form, and once the vendor accepts it, call
+    :meth:`Sources.adopt_pending_verification` to make it the source's signing secret.
+    """
+
+    provider: str
+    token: str
+    received_at: str
+    client_ip: str | None = None
+
+
+class CreateSourceParams(HookbaseModel):
+    name: str
+    #: Required: it forms the ingest URL, /ingest/<org>/<slug>, and cannot be changed later.
+    slug: str
+    provider: SourceProvider | None = None
+    description: str | None = None
+    #: What to supply depends on the provider (the catalog's signatureVerification.secretSource,
+    #: see client.providers.get):
+    #:   - "provider": the vendor issues it. Required for several (standard-webhooks and its
+    #:     aliases, airtable, gitlab-signing-token, supabase-auth-hooks, jira, discord, sendgrid);
+    #:     a missing or malformed one is a 400.
+    #:   - "operator": omit it and the API generates one, returned once on the created source.
+    #:   - "public_key": the vendor's public key (PEM or base64).
+    #:   - "built_in" (wise, wise-sandbox, aws-sns): send nothing; any secret is a 400.
+    signing_secret: str | None = None
+    #: Meta providers (whatsapp) only; a 400 for any other. Omit it and the API generates one.
+    verify_token: str | None = None
+    #: Reject events whose signature fails verification. Defaults to False.
+    reject_invalid_signatures: bool | None = None
+    rate_limit_per_minute: int | None = None
+    ip_filter_mode: IpFilterMode | None = None
+    ip_allowlist: list[str] | None = None
+    ip_denylist: list[str] | None = None
+    encrypt_fields: list[str] | None = None
+    mask_fields: list[str] | None = None
+    dedup_enabled: bool | None = None
+    dedup_strategy: DedupStrategy | None = None
+    #: Deduplication window in hours, 1 to 168.
+    dedup_window_hours: int | None = None
+    #: Header to deduplicate on when dedup_strategy is "idempotency_key".
+    dedup_custom_header: str | None = None
+    transient_mode: bool | None = None
+    #: Restrict the ingest endpoint to these verbs. None/[] accepts any method.
+    allowed_methods: list[IngestMethod] | None = None
+
+
+class UpdateSourceParams(HookbaseModel):
+    name: str | None = None
+    description: str | None = None
+    provider: SourceProvider | None = None
+    is_active: bool | None = None
+    signing_secret: str | None = None
+    #: Meta providers (whatsapp) only. "" regenerates it, as does clear=["verifyToken"].
+    verify_token: str | None = None
+    reject_invalid_signatures: bool | None = None
+    rate_limit_per_minute: int | None = None
+    ip_filter_mode: IpFilterMode | None = None
+    ip_allowlist: list[str] | None = None
+    ip_denylist: list[str] | None = None
+    encrypt_fields: list[str] | None = None
+    mask_fields: list[str] | None = None
+    dedup_enabled: bool | None = None
+    dedup_strategy: DedupStrategy | None = None
+    dedup_window_hours: int | None = None
+    dedup_custom_header: str | None = None
+    transient_mode: bool | None = None
+    #: Restrict the ingest endpoint to these verbs. Pass [] to accept any method again.
+    allowed_methods: list[IngestMethod] | None = None
+
+    clear: list[ClearableSourceField] | None = None
+    """Fields to send as an explicit JSON null.
+
+    ``None`` on any field above means "leave it alone", so it cannot also mean "remove it".
+    Naming a field here sends null for it, which PATCH /api/sources/:id accepts for the fields in
+    ``CLEARABLE_SOURCE_FIELDS``::
+
+        client.sources.update("src_1", UpdateSourceParams(clear=["signingSecret"]))
+        client.sources.update("src_1", UpdateSourceParams(clear=["verifyToken"]))  # regenerate
+
+    A field that is also set on this model raises rather than the SDK choosing one silently."""
+
+
+def update_source_body(params: UpdateSourceParams | dict[str, Any]) -> dict[str, Any]:
+    """Build the PATCH /api/sources/:id body, turning ``clear`` into explicit nulls."""
+    body = _wire.dump(params)
+    _wire.apply_clear(body, CLEARABLE_SOURCE_FIELDS, "source")
+    return body

{hookbase-3.1.0 → hookbase-3.2.0}/src/hookbase/resources/__init__.py

@@ -13,6 +13,7 @@ from .message_log import AsyncMessageLog, MessageLog
 from .messages import AsyncMessages, Messages
 from .organizations import AsyncOrganizations, Organizations
 from .portal_tokens import AsyncPortalTokens, PortalTokens
+from .providers import AsyncProviders, Providers
 from .routes import AsyncRoutes, Routes
 from .schemas import AsyncSchemas, Schemas
 from .sources import AsyncSources, Sources
@@ -36,6 +37,7 @@ __all__ = [
     "Messages", "AsyncMessages",
     "Organizations", "AsyncOrganizations",
     "PortalTokens", "AsyncPortalTokens",
+    "Providers", "AsyncProviders",
     "Routes", "AsyncRoutes",
     "Schemas", "AsyncSchemas",
     "Sources", "AsyncSources",