Webhooks

curl -X POST https://api.econtract.online/api/v1/webhooks \
  -H "Authorization: Bearer cl_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.example.com/webhooks/econtract",
    "events": ["contract.processing.completed", "contract.processing.failed", "signer.viewed", "contract.completed", "signer.declined"],
    "description": "Production"
  }'

const res = await fetch("https://api.econtract.online/api/v1/webhooks", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ECONTRACT_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    url: "https://your-app.example.com/webhooks/econtract",
    events: ["contract.processing.completed", "contract.processing.failed", "signer.viewed", "contract.completed", "signer.declined"],
    description: "Production",
  }),
});
const { id, secret } = await res.json(); // store the secret: it is shown only now

import os
import requests

res = requests.post(
    "https://api.econtract.online/api/v1/webhooks",
    headers={"Authorization": f"Bearer {os.environ['ECONTRACT_API_KEY']}"},
    json={
        "url": "https://your-app.example.com/webhooks/econtract",
        "events": ["contract.processing.completed", "contract.processing.failed", "signer.viewed", "contract.completed", "signer.declined"],
        "description": "Production",
    },
)
webhook = res.json()
secret = webhook["secret"]  # store it: it is shown only now

import crypto from "node:crypto";
import express from "express";

const SECRET = process.env.ECONTRACT_WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 300;

function verify(rawBody, header) {
  const parts = Object.fromEntries(
    String(header || "").split(",").map((p) => p.trim().split("=", 2)),
  );
  const t = Number(parts.t);
  if (!t || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - t) > TOLERANCE_SECONDS) return false;
  const expected = crypto.createHmac("sha256", SECRET).update(`${t}.${rawBody}`).digest("hex");
  const a = Buffer.from(parts.v1, "hex");
  const b = Buffer.from(expected, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

const app = express();
const seen = new Set(); // use your database in production

app.post("/webhooks/econtract", express.raw({ type: "application/json" }), (req, res) => {
  if (!verify(req.body.toString("utf8"), req.get("X-Econtract-Signature"))) {
    return res.status(401).send("invalid signature");
  }
  const event = JSON.parse(req.body.toString("utf8"));
  if (seen.has(event.id)) return res.sendStatus(200); // duplicate: already handled
  seen.add(event.id);

  // Answer fast, work in the background
  res.sendStatus(200);
  queueMicrotask(() => handle(event));
});

function handle(event) {
  if (event.event === "contract.completed") {
    // download GET /api/v1/contracts/{id}/document?version=signed and the audit trail
  }
}

app.listen(3000);

import hashlib
import hmac
import json
import os
import time

from flask import Flask, request

SECRET = os.environ["ECONTRACT_WEBHOOK_SECRET"].encode()
TOLERANCE_SECONDS = 300
app = Flask(__name__)
seen = set()  # use your database in production


def verify(raw_body: bytes, header: str) -> bool:
    try:
        parts = dict(p.strip().split("=", 1) for p in (header or "").split(","))
        t = int(parts["t"])
        received = parts["v1"]
    except (KeyError, ValueError):
        return False
    if abs(time.time() - t) > TOLERANCE_SECONDS:
        return False
    expected = hmac.new(SECRET, f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(received, expected)


@app.post("/webhooks/econtract")
def econtract_webhook():
    raw = request.get_data()  # raw bytes, before any JSON parsing
    if not verify(raw, request.headers.get("X-Econtract-Signature", "")):
        return "invalid signature", 401
    event = json.loads(raw)
    if event["id"] in seen:
        return "", 200  # duplicate: already handled
    seen.add(event["id"])
    # hand the event to a background job here
    return "", 200