Every address, accounted for.

API=https://api.ipcraft.io/api/v1

# Ask for the next free address in a subnet
curl "$API/subnets/$SUBNET_ID/first-free" \
  -H "Authorization: Bearer $IPCRAFT_KEY"
# {"ip": "10.40.18.42"}

# Record it
curl -X POST "$API/subnets/$SUBNET_ID/addresses" \
  -H "Authorization: Bearer $IPCRAFT_KEY" \
  -H "Content-Type: application/json" \
  -H "X-Requested-With: XMLHttpRequest" \
  -d '{
    "ip": "10.40.18.42",
    "hostname": "db-primary-01",
    "status": "assigned",
    "owner": "Platform team"
  }'

import os, requests

API = "https://api.ipcraft.io/api/v1"
HEADERS = {
    "Authorization": f"Bearer {os.environ['IPCRAFT_KEY']}",
    "X-Requested-With": "XMLHttpRequest",
}

# Find the next free address
free = requests.get(
    f"{API}/subnets/{subnet_id}/first-free", headers=HEADERS
).json()

# Assign it
requests.post(
    f"{API}/subnets/{subnet_id}/addresses",
    headers=HEADERS,
    json={
        "ip": free["ip"],
        "hostname": "db-primary-01",
        "status": "assigned",
        "custom_fields": {"asset_tag": "IT-05120"},
    },
).raise_for_status()

// POSTed to your endpoint when a subnet is created
{
  "event": "subnet.created",
  "delivery_id": "5f0c2e8a-3b1d-...",
  "resource_type": "subnet",
  "resource_id": "a1b2c3d4-e5f6-...",
  "timestamp": "2026-10-22T14:30:00Z",
  "data": {
    "label": "10.40.20.0/24",
    "name": "Floor 4"
  }
}

// Sent with every delivery:
// X-Webhook-Event: subnet.created
// X-Webhook-Signature: t=1792679400,v1=5257a8...
// Content-Type: application/json

import hmac, hashlib

def verify_webhook(payload: bytes, header: str,
                   event_type: str, secret: str) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    signed = f"{parts['t']}.{event_type}.".encode() + payload
    computed = hmac.new(secret.encode(), signed,
                        hashlib.sha256).hexdigest()
    return hmac.compare_digest(computed, parts["v1"])

# In your Flask or FastAPI handler
ok = verify_webhook(
    request.data,
    request.headers["X-Webhook-Signature"],
    request.headers["X-Webhook-Event"],
    "whsec_your_signing_secret",
)