WhaleCore webhook

WhaleCore sends player analysis results to this endpoint. We verify each request withX-WhaleCore-Signature and push fraud / VIP scores into Smartico viaupdate_profile.

Endpoint

https://api.cryptocasino.com/api/v1/webhooks/whalecore.json

Authentication (POST)

• X-WhaleCore-Signature: sha256=<hex>
• X-WhaleCore-Timestamp: Unix seconds
• HMAC-SHA256 over {timestamp}.{rawBody} using WHALECORE_WEBHOOK_SECRET (whsec_…)
• Reject requests older than 5 minutes

Accepted events

analysis.completed

Required payload fields

• data.player_id — Smartico CID (11 digits, 17110…). data.cid is an alias.
• data.fraud.score — number
• data.vip.score — number

Smartico mapping (default)

• Fraud score → core_custom_prop_num20
• VIP score → core_custom_prop_num21

Override with env vars WHALECORE_SMARTICO_FRAUD_SCORE_PROP / WHALECORE_SMARTICO_VIP_SCORE_PROP.

Introspection (GET)

GET /api/v1/webhooks/whalecore.json with Authorization: Bearer <WHALECORE_WEBHOOK_SECRET> returns live config metadata (mapping, tenant id flag, etc.).