Webhooks-API

{
  "ok": true,
  "data": {
    "data": [
      {
        "id": "whk_abc123",
        "name": "Produktions-Ereignishandler",
        "url": "https://api.ihreapp.de/webhooks/auris",
        "events": ["user.created", "user.updated", "login.success", "login.failed"],
        "isActive": true,
        "lastDeliveryAt": "2025-02-18T09:45:00Z",
        "failureCount": 0,
        "createdAt": "2025-01-15T10:00:00Z"
      }
    ],
    "pagination": {
      "page": 1,
      "limit": 20,
      "total": 3,
      "totalPages": 1
    }
  }
}

{
  "name": "Produktions-Ereignishandler",
  "url": "https://api.ihreapp.de/webhooks/auris",
  "events": ["user.created", "user.updated", "user.deleted", "login.success"]
}

{
  "ok": true,
  "data": {
    "id": "whk_def456",
    "name": "Produktions-Ereignishandler",
    "url": "https://api.ihreapp.de/webhooks/auris",
    "events": ["user.created", "user.updated", "user.deleted", "login.success"],
    "secret": "whsec_7f3a8b2c4d5e6f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f",
    "isActive": true,
    "createdAt": "2025-02-18T10:00:00Z"
  }
}

{
  "ok": true,
  "data": {
    "id": "whk_abc123",
    "name": "Produktions-Ereignishandler",
    "url": "https://api.ihreapp.de/webhooks/auris",
    "events": ["user.created", "user.updated", "login.success", "login.failed"],
    "isActive": true,
    "failureCount": 0,
    "lastDeliveryAt": "2025-02-18T09:45:00Z",
    "createdAt": "2025-01-15T10:00:00Z",
    "updatedAt": "2025-02-10T14:00:00Z"
  }
}

{
  "name": "Produktions-Ereignishandler v2",
  "events": ["user.created", "user.updated", "user.deleted", "login.success", "login.failed", "role.assigned"],
  "isActive": true
}

{
  "ok": true,
  "data": {
    "id": "whk_abc123",
    "name": "Produktions-Ereignishandler v2",
    "url": "https://api.ihreapp.de/webhooks/auris",
    "events": ["user.created", "user.updated", "user.deleted", "login.success", "login.failed", "role.assigned"],
    "isActive": true,
    "updatedAt": "2025-02-18T11:00:00Z"
  }
}

{
  "ok": true,
  "data": { "deleted": true }
}

{
  "ok": true,
  "data": {
    "secret": "whsec_9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a"
  }
}

{
  "ok": true,
  "data": {
    "deliveryId": "del_xyz789",
    "statusCode": 200,
    "success": true,
    "responseTime": 142
  }
}

{
  "event": "webhook.test",
  "timestamp": "2025-02-18T10:30:00Z",
  "tenant": "acme-gmbh",
  "data": {
    "message": "Dies ist eine Testzustellung von Auris.",
    "webhookId": "whk_abc123"
  }
}

{
  "ok": true,
  "data": {
    "data": [
      {
        "id": "del_abc123",
        "event": "user.created",
        "statusCode": 200,
        "success": true,
        "responseTime": 89,
        "attempts": 1,
        "payload": {
          "event": "user.created",
          "timestamp": "2025-02-18T09:45:00Z",
          "tenant": "acme-gmbh",
          "data": {
            "userId": "usr_abc123",
            "email": "[email protected]"
          }
        },
        "createdAt": "2025-02-18T09:45:00Z",
        "completedAt": "2025-02-18T09:45:01Z"
      },
      {
        "id": "del_def456",
        "event": "login.failed",
        "statusCode": 500,
        "success": false,
        "responseTime": 2034,
        "attempts": 3,
        "error": "Server returned 500 Internal Server Error",
        "payload": {
          "event": "login.failed",
          "timestamp": "2025-02-18T09:30:00Z",
          "tenant": "acme-gmbh",
          "data": {
            "email": "[email protected]",
            "reason": "INVALID_CREDENTIALS",
            "ipAddress": "203.0.113.50"
          }
        },
        "createdAt": "2025-02-18T09:30:00Z",
        "completedAt": "2025-02-18T09:35:12Z"
      }
    ],
    "pagination": {
      "page": 1,
      "limit": 20,
      "total": 156,
      "totalPages": 8
    }
  }
}

{
  "ok": true,
  "data": {
    "deliveryId": "del_ghi789",
    "statusCode": 200,
    "success": true,
    "responseTime": 95
  }
}

{
  "event": "user.created",
  "timestamp": "2025-02-18T10:00:00Z",
  "tenant": "acme-gmbh",
  "data": {
    "userId": "usr_abc123",
    "email": "[email protected]",
    "firstName": "Alice",
    "lastName": "Müller"
  }
}

import crypto from 'crypto';
 
function verifyWebhookSignature(rawBody, signature, timestamp, secret) {
  // 1. Zeitstempel-Aktualität prüfen (optional, aber empfohlen)
  const currentTime = Math.floor(Date.now() / 1000);
  if (Math.abs(currentTime - parseInt(timestamp)) > 300) {
    throw new Error('Webhook-Zeitstempel ist zu alt');
  }
 
  // 2. Erwartete Signatur berechnen
  const signedPayload = `${timestamp}.${rawBody}`;
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');
 
  // 3. Zeitkonstanter Vergleich
  const expected = Buffer.from(expectedSignature, 'hex');
  const received = Buffer.from(signature, 'hex');
 
  if (expected.length !== received.length) {
    return false;
  }
 
  return crypto.timingSafeEqual(expected, received);
}
 
// Express.js-Handler
app.post('/webhooks/auris', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const timestamp = req.headers['x-webhook-timestamp'];
  const rawBody = req.body.toString('utf-8');
 
  if (!verifyWebhookSignature(rawBody, signature, timestamp, process.env.AURIS_WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Ungültige Signatur' });
  }
 
  const event = JSON.parse(rawBody);
  console.log(`Received ${event.event}:`, event.data);
 
  // Ereignis verarbeiten...
 
  res.status(200).json({ received: true });
});

import hmac
import hashlib
import time
 
def verify_webhook_signature(raw_body: bytes, signature: str, timestamp: str, secret: str) -> bool:
    # Zeitstempel-Aktualität prüfen
    current_time = int(time.time())
    if abs(current_time - int(timestamp)) > 300:
        return False
 
    # Erwartete Signatur berechnen
    signed_payload = f"{timestamp}.{raw_body.decode('utf-8')}"
    expected = hmac.new(
        secret.encode('utf-8'),
        signed_payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
 
    # Zeitkonstanter Vergleich
    return hmac.compare_digest(expected, signature)