Webhooks API

{
  "event":       "quotation.accepted",
  "event_id":    "evt_01J5X2...",
  "delivery_id": "d63dc535-ed36-4108-965a-f498fbaf7931",
  "timestamp":   1787449633,
  "api_version": "1.0",
  "data": {
    "quotation_id":   "qtn_...",
    "client_name":    "محمد العمري",
    "property_title": "فيلا — حي الملقا، الرياض",
    "total_amount":   1250000,
    "currency":       "SAR",
    "responded_at":   "2026-08-23T17:44:33Z"
  }
}

{
  "event":     "tour.lead_captured",
  "timestamp": 1787449633,
  "data": {
    "tour_id":        "tour_...",
    "tour_title":     "جولة فيلا الملقا",
    "client_name":    "سارة الغامدي",
    "client_phone":   "0501234567",
    "request_type":   "live_tour",
    "preferred_time": "بعد الساعة 5 مساءً",
    "captured_at":    "2026-08-23T17:44:33Z"
  }
}

const crypto = require('crypto')

function verifySignature(rawBody, signature, secret) {
  const expected = 'sha256=' +
    crypto.createHmac('sha256', secret)
          .update(rawBody).digest('hex')
  return crypto.timingSafeEqual(
    Buffer.from(expected), Buffer.from(signature)
  )
}

app.post('/webhook', (req, res) => {
  const sig = req.headers['x-shoufaqar-signature']
  if (!verifySignature(JSON.stringify(req.body), sig, process.env.SECRET))
    return res.status(401).send('Invalid signature')

  const { event, data } = req.body
  console.log('Event:', event, data)
  res.sendStatus(200)
})

const crypto = require('crypto')
const secret = $env.SHOUFAQAR_SECRET
const sig    = $input.first().headers['x-shoufaqar-signature']
const body   = JSON.stringify($input.first().body)
const expected = 'sha256=' +
  crypto.createHmac('sha256', secret).update(body).digest('hex')
if (sig !== expected) throw new Error('Invalid signature')
return $input.all()