Webhooks Enterprise

curl -X PATCH "https://ryzeapi.cloud/api/account/webhook" \
  -H "token: $Token_Account" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://su-servidor.com/webhooks/ryze",
    "events": [
      "enterprise.trial.started",
      "enterprise.trial.ending",
      "enterprise.instance.billable",
      "enterprise.cycle.renewed"
    ],
    "enabled": true
  }'

await fetch("https://ryzeapi.cloud/api/account/webhook", {
  method: "PATCH",
  headers: {
    "token": process.env.Token_Account,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    url: "https://su-servidor.com/webhooks/ryze",
    events: [
      "enterprise.trial.started",
      "enterprise.trial.ending",
      "enterprise.instance.billable",
      "enterprise.cycle.renewed"
    ],
    enabled: true
  })
});

import os, requests

requests.patch(
    "https://ryzeapi.cloud/api/account/webhook",
    headers={
        "token": os.environ["Token_Account"],
        "Content-Type": "application/json",
    },
    json={
        "url": "https://su-servidor.com/webhooks/ryze",
        "events": [
            "enterprise.trial.started",
            "enterprise.trial.ending",
            "enterprise.instance.billable",
            "enterprise.cycle.renewed",
        ],
        "enabled": True,
    },
)

import crypto from "crypto";
import express from "express";

const app = express();

function verify(rawBody, header, secret) {
  const expected = crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const received = (header || "").replace(/^sha256=/, "");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(received, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// express.raw conserva los bytes crudos, necesarios para que el HMAC coincida.
app.post("/webhooks/ryze", express.raw({ type: "application/json" }), (req, res) => {
  const ok = verify(req.body, req.get("X-Ryze-Signature"), process.env.RYZE_WEBHOOK_SECRET);
  if (!ok) return res.status(401).send("bad signature");

  const event = JSON.parse(req.body.toString("utf8"));
  // ... trate el evento (event.event, event.data) ...
  res.sendStatus(200);
});

import hmac, hashlib, os
from flask import Flask, request, abort

app = Flask(__name__)

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    received = (header or "").removeprefix("sha256=")
    return hmac.compare_digest(expected, received)

@app.post("/webhooks/ryze")
def ryze_webhook():
    raw = request.get_data()  # bytes crudos, necesarios para que el HMAC coincida
    if not verify(raw, request.headers.get("X-Ryze-Signature", ""), os.environ["RYZE_WEBHOOK_SECRET"]):
        abort(401)

    event = request.get_json()
    # ... trate el evento (event["event"], event["data"]) ...
    return "", 200