API

Buildix can POST events to your own server: Entry Signals, their outcome four hours later, and your alerts. Register an endpoint in Dashboard → Alerts (5 endpoints on Pro, 20 on Whale and API). Each endpoint gets a signing secret, shown once, that you can rotate.

• entry_signal.created: a new Entry Signal matching an Entry Signal alert that uses the endpoint (same pairs, timeframe and minimum grade as the Telegram and email channel). Pro and above. On HIP-3 markets (symbols such as xyz:NVDA) a signal whose bar falls outside the market's trading session is sent with its grade lowered one step and two extra fields in data: session ("closed") and grade_before_session. Crypto signals and open-session signals never carry them.
• signal.outcome: four hours after each delivered signal, the move in the signal's direction, the best and worst excursion and which level was touched first. Computed from the 5m bars Buildix already holds, with the same price rule as the public channel follow up.
• alert.triggered: an alert (price, screener, sweep, delta flip, drawing) whose webhook URL is a registered endpoint. data carries the same fields as the previous flat payload, plus alert_kind.
• test: sent by the Send test event button.

Every event has the same envelope. id is stable: a retry of the same event carries the same id, so store it and ignore duplicates. New fields may be added to data; a breaking change would ship as version "2".

{
  "id": "evt_9f2c41d0b6a84e5f8c1d2e3f4a5b6c7d",
  "type": "entry_signal.created",
  "version": "1",
  "created_at": "2026-09-26T10:15:04.211Z",
  "data": {
    "signal_id": "BTC-15m-1758880800000-long",
    "symbol": "BTC",
    "timeframe": "15m",
    "side": "long",
    "grade": "A",
    "score": 0.81,
    "bar_time": "2026-09-26T10:00:00.000Z",
    "regime": "trend_up",
    "confirmed": true,
    "flow_source": "trades",
    "logics": { "liquidity_grab": true, "flow_rejection": true, "absorption": false,
                "cvd_divergence": true, "structure_shift": false, "level_confluence": true },
    "plan": { "entry": 64210.5, "stop": 63880.0, "t1": 64706.0, "t2": 65201.5, "r_t1": 1.5, "r_t2": 3 },
    "price_at_signal": 64215.0,
    "chart_url": "https://www.buildix.trade/pair/BTC"
  }
}

{
  "id": "evt_0b7e...",
  "type": "signal.outcome",
  "version": "1",
  "created_at": "2026-09-26T14:15:30.002Z",
  "data": {
    "entry_event_id": "evt_9f2c41d0b6a84e5f8c1d2e3f4a5b6c7d",
    "signal_id": "BTC-15m-1758880800000-long",
    "symbol": "BTC", "timeframe": "15m", "side": "long", "grade": "A",
    "horizon": "4h",
    "signaled_at": "2026-09-26T10:15:04.211Z",
    "evaluated_at": "2026-09-26T14:15:30.002Z",
    "price_at_signal": 64215.0,
    "price_after": 64890.0,
    "move_pct": 1.0512,
    "max_favorable_pct": 1.4201,
    "max_adverse_pct": -0.3105,
    "first_level_hit": "t1",
    "t2_hit": false
  }
}

first_level_hit is stop, t1, none, or both_same_bar when one 5m bar spans both levels and the order inside the bar is unknown.

Content-Type: application/json
X-Buildix-Event: entry_signal.created
X-Buildix-Event-Id: evt_9f2c41d0b6a84e5f8c1d2e3f4a5b6c7d
X-Buildix-Delivery: <uuid of this delivery>
X-Buildix-Attempt: 1
X-Buildix-Timestamp: 1758881704
X-Buildix-Signature: v1=<hex HMAC-SHA256(secret, "<timestamp>.<raw body>")>

Compute the HMAC over the timestamp, a dot and the raw request body exactly as received, and compare in constant time. Reject a timestamp more than 300 seconds away from your clock (replay protection) and an event id you already handled. For 24 hours after a rotation the header carries two entries, v1=<new>,v1=<old>: accept the request when any entry matches.

// Node 18+ (Express). Verify on the RAW body, before JSON parsing.
import crypto from 'node:crypto';
import express from 'express';

const SECRET = process.env.BUILDIX_WEBHOOK_SECRET; // whsec_...
const TOLERANCE_S = 300;
const seen = new Set(); // use your database in production

function verify(rawBody, timestamp, signatureHeader) {
  if (!timestamp || !signatureHeader) return false;
  const ts = Number(timestamp);
  if (!Number.isInteger(ts) || Math.abs(Date.now() / 1000 - ts) > TOLERANCE_S) return false;
  const expected = crypto.createHmac('sha256', SECRET).update(`${ts}.${rawBody}`).digest();
  return signatureHeader.split(',').some((part) => {
    const [scheme, hex] = part.trim().split('=');
    if (scheme !== 'v1' || !/^[0-9a-f]{64}$/.test(hex || '')) return false;
    return crypto.timingSafeEqual(Buffer.from(hex, 'hex'), expected);
  });
}

const app = express();
app.post('/buildix', express.raw({ type: 'application/json' }), (req, res) => {
  const raw = req.body.toString('utf8');
  if (!verify(raw, req.get('X-Buildix-Timestamp'), req.get('X-Buildix-Signature'))) {
    return res.status(401).end();
  }
  const event = JSON.parse(raw);
  if (seen.has(event.id)) return res.status(200).end(); // retry of an event already handled
  seen.add(event.id);
  res.status(200).end(); // answer fast, work after
  // handle event.type / event.data here
});
app.listen(3000);

# Python 3.10+ (Flask). Verify on the RAW body, before JSON parsing.
import hashlib, hmac, json, os, time
from flask import Flask, request, abort

SECRET = os.environ["BUILDIX_WEBHOOK_SECRET"].encode()  # whsec_...
TOLERANCE_S = 300
seen = set()  # use your database in production

def verify(raw: bytes, timestamp: str | None, signature_header: str | None) -> bool:
    if not timestamp or not signature_header or not timestamp.isdigit():
        return False
    if abs(time.time() - int(timestamp)) > TOLERANCE_S:
        return False
    expected = hmac.new(SECRET, f"{timestamp}.".encode() + raw, hashlib.sha256).hexdigest()
    for part in signature_header.split(","):
        scheme, _, value = part.strip().partition("=")
        if scheme == "v1" and hmac.compare_digest(value, expected):
            return True
    return False

app = Flask(__name__)

@app.post("/buildix")
def buildix():
    raw = request.get_data()
    if not verify(raw, request.headers.get("X-Buildix-Timestamp"), request.headers.get("X-Buildix-Signature")):
        abort(401)
    event = json.loads(raw)
    if event["id"] in seen:
        return "", 200  # retry of an event already handled
    seen.add(event["id"])
    # handle event["type"] / event["data"] here
    return "", 200

• https only, port 443, public addresses only (checked on every delivery), redirects are not followed, 5 second timeout, request body up to 64 KB. Answer with any 2xx as soon as you have stored the event.
• A failed delivery is retried after 1 min, 5 min, 30 min, 2 h (5 attempts in total). A 410, or a 404 from Discord or Slack, means the webhook is gone and the endpoint is disabled at once.
• After 20 failed deliveries in a row spanning at least 24 hours the endpoint is disabled; you get an in-app notification and an email, and you can turn it back on from the dashboard.
• Limits: an alert sends at most one webhook every 5 minutes, whatever its cooldown (email, Telegram and in-app keep the alert's own cooldown). When 50 deliveries of an endpoint are already waiting for a retry, new events for that endpoint are dropped until the backlog clears (older ones keep their retries; the delivery log shows one backlog line per hour). An account receives at most 2,000 webhook events per day (Europe/Rome day).
• Discord and Slack incoming webhook URLs receive a formatted message (embed or blocks) instead of the raw JSON.
• The dashboard shows the last 50 deliveries of each endpoint (kept 3 days). Send test event is limited to 5 per minute and 20 per day.
• An alert webhook URL that is not registered as an endpoint keeps receiving the previous flat, unsigned JSON. Register the same URL to switch it to the signed envelope.