import requests
API = "https://humanlayer.systems/api/v1/decisions"
HEADERS = {"x-api-key": "hl_live_..."}
# Seuil Arbitrium franchi : on soumet le dossier
created = requests.post(API, headers=HEADERS, json={
"agent_id": "agent-credit",
"request_type": "compliance", # niveau 1, SLA 30 min
"domain": "finance",
"summary": "KYC : correspondance partielle. Valider ?",
"context_json": {"customer_id": "c_4521"},
"callback_url": "https://votre-app.example/hl",
}).json()
# Suivi (ou attente du webhook signé)
res = requests.get(API, headers=HEADERS,
params={"id": created["request_id"]})
req = res.json()["request"]
if req["verdict"] == "approved":
continue_workflow(req["decision"]) # signée Ed25519
import hmac, hashlib, time
def verify_webhook(headers, raw_body, secret):
# X-HumanLayer-Signature: t=1700000000,v1=<hmac>
parts = dict(p.split("=", 1)
for p in headers["X-HumanLayer-Signature"].split(","))
if abs(time.time() - int(parts["t"])) > 300:
return False # trop ancien : rejeu
signed = parts["t"].encode() + b"." + raw_body
expected = hmac.new(secret.encode(), signed,
hashlib.sha256).hexdigest()
return hmac.compare_digest(expected, parts["v1"])
// POST vers votre callback_url (X-HumanLayer-Event: decision.completed)
{
"id": "evt_3c9e…",
"type": "decision.completed",
"data": {
"request_id": "8b1f2c4e-…",
"status": "decided",
"verdict": "approved",
"reasoning": "Conforme à la politique interne.",
"sentinel_ref": "S-4F2A9C",
"signed_at": "2026-03-12T14:32:07Z",
"signature": "base64…",
"signed_payload": "{…}"
}
}