Webhooks

X-Tybrite-Signature: t=<unix_timestamp>,v1=<hmac_sha256_hex>

import { createHmac, timingSafeEqual } from 'crypto';

function verifyTybriteWebhook(
  rawBody: string,
  signature: string,
  signingSecret: string
): boolean {
  const [tPart, v1Part] = signature.split(',');
  const timestamp = tPart.replace('t=', '');
  const receivedSig = v1Part.replace('v1=', '');

  // Reject replays older than 5 minutes
  if (Math.abs(Date.now() / 1000 - parseInt(timestamp)) > 300) return false;

  const payload = `${timestamp}.${rawBody}`;
  const expected = createHmac('sha256', signingSecret).update(payload).digest('hex');

  return timingSafeEqual(Buffer.from(receivedSig), Buffer.from(expected));
}

// In an Express handler:
app.post('/webhooks/tybrite', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.headers['x-tybrite-signature'] as string;
  if (!verifyTybriteWebhook(req.body.toString(), sig, process.env.TYBRITE_WEBHOOK_SECRET!)) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body.toString());
  switch (event.type) {
    case 'order.paid':
      await syncToErp(event.data.object);
      break;
    case 'payment.failed':
      await notifyOps(event.data.object);
      break;
  }

  res.json({ received: true });
});

const { webhook_endpoint } = await client.webhooks.createWebhookEndpoint({
  requestBody: {
    url: 'https://yourapp.com/webhooks/tybrite',
    events: ['order.paid', 'order.fulfilled', 'payment.succeeded', 'payment.failed'],
    enabled: true,
    metadata: { label: 'production-erp', team: 'platform' }
  }
});

// signing_secret is returned ONCE — store it immediately
const signingSecret = webhook_endpoint.signing_secret;
console.log('Store this secret:', signingSecret);

await client.webhooks.createWebhookEndpoint({
  requestBody: {
    url: 'https://yourapp.com/webhooks/tybrite',
    events: ['*'], // receive everything
  }
});
// → { webhook_endpoint: { id, url, events: ['*'], enabled: true, signing_secret, … } }

const { webhook_endpoints, pagination } = await client.webhooks.listWebhookEndpoints({
  limit: 20,
});

const { webhook_endpoint } = await client.webhooks.getWebhookEndpoint({
  id: 'endpoint-uuid',
});

console.log(webhook_endpoint.delivery_stats);
// { total: 1420, successful: 1418, failed: 2 }

console.log(webhook_endpoint.consecutive_failures); // 0 when healthy
console.log(webhook_endpoint.disabled_reason);      // null unless auto-disabled

await client.webhooks.updateWebhookEndpoint({
  id: 'endpoint-uuid',
  requestBody: { enabled: true } // resets consecutive_failures, clears disabled_reason
});
// → { webhook_endpoint: { …, enabled: true, consecutive_failures: 0, disabled_reason: null, disabled_at: null } }

// Disable an endpoint temporarily
await client.webhooks.updateWebhookEndpoint({
  id: 'endpoint-uuid',
  requestBody: { enabled: false }
});
// → { webhook_endpoint: { …, enabled: false } }

// Change subscribed events
const { webhook_endpoint } = await client.webhooks.updateWebhookEndpoint({
  id: 'endpoint-uuid',
  requestBody: {
    events: ['order.paid', 'order.cancelled', 'payment.failed']
  }
});

await client.webhooks.deleteWebhookEndpoint({ id: 'endpoint-uuid' });
// → { success: true, message: 'Webhook endpoint deleted' }

const result = await client.webhooks.sendTestWebhookEvent({
  id: 'endpoint-uuid',
  requestBody: { event_type: 'order.paid' }
});

console.log(result.success);     // true
console.log(result.status_code); // 200

// All events
const { webhook_events } = await client.webhooks.listWebhookEvents({ limit: 50 });

// Filter by type
const { webhook_events: failedPayments } = await client.webhooks.listWebhookEvents({
  type: 'payment.failed',
  limit: 20,
});

// Filter by environment (production vs sandbox/test)
const { webhook_events: liveEvents } = await client.webhooks.listWebhookEvents({
  environment: 'production',
  limit: 50,
});

const { webhook_event } = await client.webhooks.getWebhookEvent({
  id: 'evt_1716199800000_abc123'
});

// Inspect delivery attempts
for (const delivery of webhook_event.deliveries) {
  console.log(delivery.attempt_number, delivery.success, delivery.status_code, delivery.latency_ms);
}

const result = await client.webhooks.retryWebhookEvent({
  id: 'evt_1716199800000_abc123'
});

console.log(`Retried to ${result.retried} endpoint(s)`);
for (const r of result.results) {
  console.log(r.endpoint_id, r.success, r.status_code);
}

{
  "id": "evt_1716199800000_abc123",
  "type": "order.paid",
  "created_at": "2026-05-20T10:30:00Z",
  "store_id": "store-uuid",
  "api_version": "v1",
  "livemode": true,
  "data": {
    "object": { /* the resource — order, payment, customer, etc. */ }
  },
  "previous_attributes": {
    /* on update events: prior values for changed fields only */
  }
}

const event = JSON.parse(req.body.toString());

if (event.test) return res.json({ received: true });      // synthetic — acknowledge, do nothing
if (!event.livemode) return res.json({ received: true }); // sandbox — ignore in production handler

await processEvent(event); // real, production event

const event = JSON.parse(req.body.toString());

// Idempotency check
if (await db.webhookEvents.exists(event.id)) {
  return res.json({ received: true }); // already processed
}

await db.webhookEvents.markSeen(event.id);
await processEvent(event);