CyberPocket API v1
A small, read-only API over your own CyberPocket data, plus signed outbound webhooks for finished verdicts. Create keys on the API keys page and destinations on the webhooks page.
Send your key as Authorization: Bearer cp_live_… (or x-api-key). Keys are scoped: read:analyses and read:stats. Only your own records are ever returned, and raw alert text and internal notes are never exposed.
Query params: limit (1–100, default 20). Returns id, created_at, audience, goal, source, tags and the verdict summary.
curl -H "Authorization: Bearer cp_live_..." \ "https://cyberpocket.org/api/public/v1/analyses?limit=20"
The key stays in your browser for this request only — it is never stored.
When you save an analysis, CyberPocket POSTs a metadata-only JSON payload to each active destination with a CyberPocket-Signature: t=<unix>,v1=<hex> header (HMAC-SHA256 over <t>.<raw body>). Destinations must be public HTTPS endpoints; ten consecutive failures pause a destination automatically.
// Node / Web Crypto — verify a verdict webhook
const [tPart, v1Part] = header.split(",");
const t = tPart.slice(2);
const expected = hmacSha256Hex(secret, `${t}.${rawBody}`);
if (!timingSafeEqual(expected, v1Part.slice(3))) reject();
if (Date.now() / 1000 - Number(t) > 300) reject(); // replay window