Webhooks

{
  "data": {
    "type": "transaction_updated",
    "id": "pt_ABC123",
    "status": "paid",
    "settlement_status": "paid",
    "amount": {
      "value": 1000,
      "currency": "USD"
    },
    "settlement_amount": 1000,
    "settlement_currency": "USDC",
    "settlement_fee": 25,
    "amount_paid": 1000,
    "amount_received": 1000,
    "amount_remaining": 0,
    "history": [
      {
        "time": 1714124827333,
        "status": "success",
        "description": "Payment created"
      },
      {
        "time": 1714124900000,
        "status": "success",
        "description": "Customer paid"
      }
    ],
    "metadata": {}
  }
}

const crypto = require('crypto');
const express = require('express');
const app = express();

// Captura el cuerpo sin procesar para la ruta del webhook (NO uses express.json() aquí).
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-webhook-auth'];
  const rawBody = req.body; // Buffer — los bytes exactos que Ebioro firmó

  const expected = crypto
    .createHmac('sha256', TU_API_SECRET_KEY)
    .update(rawBody)
    .digest('hex');

  const valid =
    signature &&
    expected.length === signature.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));

  if (!valid) {
    return res.status(401).send('Firma inválida');
  }

  const { type, status, id } = JSON.parse(rawBody.toString()).data;
  // Procesar el webhook...

  res.status(200).send('OK');
});

# Encontrar entregas fallidas de un pago
GET /merchants/{merchantId}/webhook-logs?status=failed&checkout_id=pt_ABC123

# Inspeccionar una entrega — incluye el payload exacto enviado y la respuesta de tu endpoint
GET /merchants/{merchantId}/webhook-logs/{id}

# Reenviarla a tu endpoint
POST /merchants/{merchantId}/webhook-logs/{id}/resend