Public API

Authentication

All requests must include a bearer token from an active API key.

curl -H "Authorization: Bearer blkx_..." \
  https://qzcjtettgksztwudgtdi.supabase.co/functions/v1/public-api/deals

Endpoints

Base URL: https://qzcjtettgksztwudgtdi.supabase.co/functions/v1/public-api

• GET/dealsList your deals (brand scope). `?limit=`
• POST/dealsCreate a brand deal. Body: `creator_name`, `platform`, `deal_value`, `deliverables[]`, `deal_terms`
• GET/deals/:idFetch one deal
• GET/contracts/:idFetch a contract
• GET/invoicesList creator + brand invoices
• GET/eventsRecent webhook deliveries
• GET/webhooksList webhook endpoints
• POST/webhooksRegister endpoint. Body: `url`, `events[]`
• DELETE/webhooks/:idRevoke endpoint

Webhook events

• deal.createdA brand deal was created
• deal.acceptedCreator accepted the deal
• deal.declinedCreator declined the deal
• deal.signedDeal moved to signed status
• deal.completedDeal marked completed
• contract.signedA contract was signed by both parties
• invoice.paidAn invoice (creator or brand direction) was paid

Payload shape: { event, created_at, data }. Deliveries retry with exponential backoff up to 6 attempts.

Verify a webhook

// Node — verify webhook signature
import crypto from "node:crypto";
const sig = req.headers["x-blackx-signature"];   // "sha256=<hex>"
const expected = "sha256=" + crypto.createHmac("sha256", SECRET).update(rawBody).digest("hex");
if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) return res.status(401).end();