Вебхуки

curl -X POST https://api.bazex.co/webhooks \
  -H "Authorization: Bearer fbat_..." \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.com/webhooks/bazex",
    "events": ["order.created", "order.status_changed", "product.updated"],
    "description": "Main webhook endpoint"
  }'

{
  "id": "clx1webhook123",
  "url": "https://your-app.com/webhooks/bazex",
  "secret": "whsec_a1b2c3d4e5f6a7b8c9d0e1f2",
  "events": ["order.created", "order.status_changed", "product.updated"],
  "isActive": true,
  "createdAt": "2026-02-20T10:00:00.000Z"
}

{
  "event": "order.created",
  "timestamp": "2026-02-20T10:30:45.123Z",
  "webhookId": "clx1webhook123",
  "businessId": "clx1business456",
  "data": {
    "orderId": "clx1order789",
    "orderNumber": "1042",
    "amount": 1590,
    "deliveryFee": 200,
    "deliveryMethod": "DELIVERY",
    "paymentMethod": "CARD",
    "isGuest": false,
    "createdAt": "2026-02-20T10:30:45.000Z"
  }
}

signature = HMAC-SHA256(secret, "${timestamp}.${rawBody}")

import { verifySignature, isTimestampFresh } from '@bazex/app-sdk';

app.post('/webhooks/bazex', (req, res) => {
  const signature = req.headers['x-webhook-signature'] as string;
  const timestamp = parseInt(req.headers['x-webhook-timestamp'] as string);
  const rawBody = JSON.stringify(req.body);

  // Verify signature (constant-time comparison)
  if (!verifySignature(signature, timestamp, rawBody, WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  // Check timestamp freshness (default: 5 min window)
  if (!isTimestampFresh(timestamp)) {
    return res.status(401).send('Timestamp too old');
  }

  // Process the event
  const { event, data } = req.body;
  console.log(`Received ${event}`, data);

  // Respond quickly — process async
  res.status(200).send('OK');
});

const crypto = require('crypto');

function verify(signature, timestamp, body, secret) {
  const payload = `${timestamp}.${body}`;
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected),
  );
}

app.post('/webhooks/bazex', async (req, res) => {
  const eventId = req.headers['x-bazex-event-id'] as string;

  // Check if already processed
  if (await db.processedEvents.findUnique({ where: { id: eventId } })) {
    return res.status(200).send('Already processed');
  }

  // Process event...
  await db.processedEvents.create({ data: { id: eventId } });
  res.status(200).send('OK');
});

curl -X POST https://api.bazex.co/webhooks/WEBHOOK_ID/test \
  -H "Authorization: Bearer fbat_..."

{
  "event": "business.data_erasure",
  "timestamp": "2026-02-22T12:00:00.000Z",
  "webhookId": "clx1webhook123",
  "businessId": "clx1business456",
  "data": {
    "appId": "clx1app789",
    "businessId": "clx1business456",
    "uninstalledAt": "2026-02-20T12:00:00.000Z"
  }
}