Webhooks

curl -X POST https://api.apyconnect.io/v1/webhooks \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{ "url": "https://your-server.com/webhooks/apyconnect",
        "events": ["contact.created", "message.*"] }'

{
  "id": "evt_…",
  "type": "contact.created",
  "created_at": "2026-07-22T12:00:00.000Z",
  "data": { "object": "contact", "id": "per_…", "name": "Ada Lovelace" }
}

X-ApyConnect-Event: contact.created
X-ApyConnect-Delivery: whd_…
X-ApyConnect-Timestamp: 1721649600
X-ApyConnect-Signature: sha256=<hmac_hex>

import crypto from "node:crypto";

function verify(req, secret) {
  const ts = req.headers["x-apyconnect-timestamp"];
  const sig = req.headers["x-apyconnect-signature"];        // "sha256=…"
  const expected = "sha256=" + crypto.createHmac("sha256", secret)
    .update(`${ts}.${req.rawBody}`).digest("hex");
  const ok = crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
  const fresh = Math.abs(Date.now() / 1000 - Number(ts)) < 300;
  return ok && fresh;
}

{ "object": "record", "id": "cor_…", "object_key": "policies", "object_id": "cob_…",
  "changed": ["premium", "stage"] }

{ "object": "approval", "id": "apr_…", "subject_type": "record", "subject_id": "cor_…", "to_stage": "produccion" }