API Reference

import hmac
import hashlib
import time
from flask import Flask, request, jsonify

app = Flask(__name__)
WEBHOOK_SECRET = 'your-webhook-secret'

def verify_webhook_signature(payload, signature, timestamp):
    five_minutes_ago = int(time.time()) - 300
    if int(timestamp) < five_minutes_ago:
        raise ValueError('Webhook timestamp too old')

    signed_payload = f"{timestamp}.{payload}"
    expected_signature = hmac.new(
        WEBHOOK_SECRET.encode('utf-8'),
        signed_payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(signature, expected_signature)

@app.route('/webhook', methods=['POST'])
def webhook():
    signature = request.headers.get('X-Webhook-Signature')
    timestamp = request.headers.get('X-Webhook-Timestamp')
    payload = request.get_data(as_text=True)

    try:
        if not verify_webhook_signature(payload, signature, timestamp):
            return jsonify({'error': 'Invalid signature'}), 401

        data = request.get_json()
        print('Webhook verified:', data)
        return jsonify({'received': True}), 200
    except Exception as e:
        return jsonify({'error': str(e)}), 400

<?php

define('WEBHOOK_SECRET', 'your-webhook-secret');

function verifyWebhookSignature($payload, $signature, $timestamp) {
    $fiveMinutesAgo = time() - 300;
    if ($timestamp < $fiveMinutesAgo) {
        throw new Exception('Webhook timestamp too old');
    }

    $signedPayload = $timestamp . '.' . $payload;
    $expectedSignature = hash_hmac('sha256', $signedPayload, WEBHOOK_SECRET);

    return hash_equals($signature, $expectedSignature);
}

$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$timestamp = $_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'] ?? '';
$payload = file_get_contents('php://input');

try {
    if (!verifyWebhookSignature($payload, $signature, $timestamp)) {
        http_response_code(401);
        echo json_encode(['error' => 'Invalid signature']);
        exit;
    }

    $data = json_decode($payload, true);
    error_log('Webhook verified: ' . print_r($data, true));

    http_response_code(200);
    echo json_encode(['received' => true]);
} catch (Exception $e) {
    http_response_code(400);
    echo json_encode(['error' => $e->getMessage()]);
}
?>

#!/bin/bash

WEBHOOK_URL="https://your-domain.com/webhook"
PAYLOAD='{"event":"workorder.created","data":{"id":"wo_123"}}'
TIMESTAMP=$(date +%s)
SECRET="your-webhook-secret"

SIGNATURE=$(echo -n "${TIMESTAMP}.${PAYLOAD}" | \
  openssl dgst -sha256 -hmac "$SECRET" | \
  sed 's/^.* //')

curl -X POST "$WEBHOOK_URL" \
  -H "Content-Type: application/json" \
  -H "X-Webhook-Signature: $SIGNATURE" \
  -H "X-Webhook-Timestamp: $TIMESTAMP" \
  -H "X-Webhook-Event: workorder.created" \
  -H "X-Webhook-ID: test_$(uuidgen)" \
  -H "X-Webhook-Retry: 0" \
  -d "$PAYLOAD"