Webhooks

{
  "id": "cmg3k2p8x0001q1a9d4z7w6e5",
  "type": "message.delivered",
  "created_at": "2026-09-22T09:41:38.579Z",
  "workspace_id": "cmc0org00000000000000001",
  "workspace_name": "Acme",
  "data": {
    "id": "cmqzkdkul0007p20mf0r4tz21",
    "status": "delivered",
    "to": "+972501234567",
    "from": "Sendy",
    "credits_charged": 1,
    "credits_refunded": 0,
    "refunded": false,
    "error_code": null,
    "created_at": "2026-09-22T09:41:32.877Z",
    "sent_at": "2026-09-22T09:41:36.932Z",
    "delivered_at": "2026-09-22T09:41:38.579Z",
    "idempotency_key": "order-1001"
  }
}

{
  "id": "cmg3k5r1d0002q1a9h8j2k4m6",
  "type": "inbound.received",
  "created_at": "2026-09-22T10:15:00.412Z",
  "workspace_id": "cmc0org00000000000000001",
  "workspace_name": "Acme",
  "data": {
    "id": "cmc0inbound0001",
    "from": "+972501234567",
    "to": "+972531234567",
    "text": "אשמח לקבל פרטים נוספים",
    "opt_out": "none",
    "opt_out_applied_at": null,
    "received_at": "2026-09-22T10:15:00.000Z"
  }
}

{
  "id": "cmg3k6t4f0003q1a9n1p3r5t7",
  "type": "contact.opted_out",
  "created_at": "2026-09-22T10:16:02.312Z",
  "workspace_id": "cmc0org00000000000000001",
  "workspace_name": "Acme",
  "data": {
    "id": "cmc0contact0001",
    "phone": "+972529876543",
    "first_name": "Dana",
    "last_name": "Levi",
    "email": null,
    "birthday": null,
    "custom_field_1": null,
    "custom_field_2": null,
    "custom_field_3": null,
    "subscribed": false,
    "source": "MANUAL",
    "segments": [{ "id": "cmc0seg0001", "name": "Newsletter" }],
    "created_at": "2026-07-15T10:00:00.000Z",
    "updated_at": "2026-09-22T10:16:02.312Z"
  },
  "context": { "reason": "sms_reply", "campaign_id": "cmc0campaign0001", "inbound_id": "cmc0inbound0002" }
}

{
  "id": "cmc0campaign0001",
  "name": "מבצע סוף שנה",
  "status": "completed",
  "sender": "MyShop",
  "recipients": 1508,
  "messages_sent": 1500,
  "messages_delivered": 1437,
  "messages_failed": 50,
  "messages_blocked": 8,
  "delivery_rate": 95.29,
  "unsubscribe_rate": 0.53,
  "credits_used": 3016,
  "credits_refunded": 16,
  "created_at": "2026-09-20T08:00:00.000Z",
  "scheduled_at": "2026-09-21T07:00:00.000Z",
  "started_at": "2026-09-21T07:00:02.000Z",
  "completed_at": "2026-09-21T07:01:17.000Z"
}

POST /webhooks/sendy HTTP/1.1
Host: hooks.example.com
Content-Type: application/json; charset=utf-8
User-Agent: Sendy-Webhooks/1.0
Sendy-Event-Id: cmg3k2p8x0001q1a9d4z7w6e5
Sendy-Event-Type: message.delivered
Sendy-Delivery-Id: cmg3k2p8x0001q1a9d4z7w6e5.1
Sendy-Signature: t=1758535298,v1=5f1c0e2b9a7d4c6e8f0a1b2c3d4e5f60718293a4b5c6d7e8f9a0b1c2d3e4f5a6

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifySendySignature(rawBody: string, header: string, secret: string, toleranceSec = 300): boolean {
  // Never throw on a malformed header: an invalid request is rejected with `false`, not a 500.
  // Only a bounded decimal timestamp and 64-hex-char signatures reach the comparison.
  const pairs = header.split(",").map((p) => p.trim().split("=")).filter((p): p is [string, string] => p.length === 2);
  const t = pairs.find(([k]) => k === "t")?.[1];
  const sigs = pairs.filter(([k, v]) => k === "v1" && /^[0-9a-f]{64}$/i.test(v)).map(([, v]) => v.toLowerCase());
  if (!t || !/^\d{1,12}$/.test(t) || sigs.length === 0) return false;
  if (Math.abs(Date.now() / 1000 - Number(t)) > toleranceSec) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  return sigs.some((s) => timingSafeEqual(Buffer.from(s, "ascii"), Buffer.from(expected, "ascii")));
}

// Express: read the RAW body — app.post("/webhooks/sendy", express.raw({ type: "application/json" }), (req, res) => {
//   if (!verifySendySignature(req.body.toString("utf8"), req.get("Sendy-Signature") ?? "", process.env.SENDY_WEBHOOK_SECRET!)) return res.sendStatus(401);
//   res.sendStatus(200);           // answer first …
//   handle(JSON.parse(req.body));  // … then process
// });

import hmac, hashlib, re, time

def verify_sendy_signature(raw_body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    # Never raise on a malformed header: an invalid request is rejected with False, not a 500.
    # Only a bounded decimal timestamp and 64-hex-char signatures reach the comparison.
    pairs = [p.strip().split("=", 1) for p in header.split(",")]
    pairs = [p for p in pairs if len(p) == 2]
    t = next((v for k, v in pairs if k == "t"), None)
    sigs = [v.lower() for k, v in pairs if k == "v1" and re.fullmatch(r"[0-9a-fA-F]{64}", v)]
    if t is None or not re.fullmatch(r"[0-9]{1,12}", t) or not sigs or abs(time.time() - int(t)) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(s, expected) for s in sigs)

# Flask: verify_sendy_signature(request.get_data(), request.headers.get("Sendy-Signature", ""), SECRET)