Webhooks

{
  "event": "charge.paid",
  "timestamp": "2024-01-15T10:05:23.000Z",
  "data": {
    "chargeId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "externalId": "txid_abc123xyz",
    "amount": 150.50,
    "netAmount": 145.99,
    "fee": 4.51,
    "status": "paid",
    "method": "PIX",
    "endToEnd": "E12345678202401151005abc123xyz456",
    "customer": {
      "name": "João da Silva",
      "cpf": "12345678901",
      "email": "joao@email.com"
    },
    "paidAt": "2024-01-15T10:05:23.000Z",
    "externalReference": "ORDER-12345",
    "split": [
      {
        "subAccountId": "b2c3d4e5-...",
        "subAccountName": "Maria Recebedora",
        "type": "PERCENT",
        "value": 30,
        "amount": 43.80,
        "status": "CREDITED"
      }
    ]
  }
}

{
  "event": "withdrawal.completed",
  "timestamp": "2024-01-15T14:30:00.000Z",
  "data": {
    "withdrawalId": "wd_e5f6-7890-abcd-ef1234567890",
    "amount": 500.00,
    "netAmount": 497.00,
    "fee": 3.00,
    "status": "completed",
    "pixKey": "joao@email.com",
    "pixKeyType": "EMAIL",
    "endToEnd": "E12345678202401151430xyz789abc123",
    "processedAt": "2024-01-15T14:30:00.000Z"
  }
}

{
  "event": "recurrence.approved",
  "recurrenceId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "idRec": "RR1234567820260810abcdefghijk",
  "status": "APPROVED",
  "amount": "49.90",
  "periodicity": "MONTHLY",
  "externalReference": "ASSINATURA-001",
  "customer": {
    "name": "João da Silva",
    "cpf": "12345678901"
  }
}

{
  "event": "recurrence.charge.paid",
  "recurrenceId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "idRec": "RR1234567820260810abcdefghijk",
  "status": "APPROVED",
  "amount": "49.90",
  "periodicity": "MONTHLY",
  "externalReference": "ASSINATURA-001",
  "customer": {
    "name": "João da Silva",
    "cpf": "12345678901"
  },
  "charge": {
    "chargeId": "b2c3d4e5-f6a7-8901-bcde-f23456789012",
    "transactionId": "c3d4e5f6-a7b8-9012-cdef-345678901234",
    "externalId": "txid_abc123xyz",
    "cycle": 2,
    "dueDate": "2026-09-10",
    "amount": "49.90",
    "endToEndId": "E12345678202609101005abc123xyz456",
    "paidAt": "2026-09-10T10:05:23.000Z"
  }
}

{
  "event": "subaccount.approved",
  "timestamp": "2026-07-09T14:00:00.000Z",
  "data": {
    "subAccountId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "name": "Maria Recebedora",
    "document": "12345678901",
    "pixKey": "maria@email.com",
    "status": "APPROVED"
  }
}

{
  "event": "subaccount.transfer.completed",
  "timestamp": "2026-07-18T11:05:00.000Z",
  "data": {
    "transferId": "f0e1d2c3-b4a5-6789-0abc-def123456789",
    "subAccountId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "subAccountName": "Maria Recebedora",
    "externalReference": "repasse-loja-01",
    "amount": 150.5,
    "netAmount": 148.5,
    "fee": 2,
    "feeChargedTo": "SUBACCOUNT",
    "status": "completed",
    "failedReason": null,
    "pixKey": "maria@email.com",
    "pixKeyType": "EMAIL",
    "endToEnd": "E12345678202607181105abcdef12345",
    "createdAt": "2026-07-18T11:00:00.000Z",
    "processedAt": "2026-07-18T11:05:00.000Z"
  }
}

const crypto = require('crypto');
const express = require('express');
const app = express();

// IMPORTANTE: Usar express.raw() para capturar o body bruto
// A assinatura HMAC é calculada sobre o body exato enviado
app.post('/webhooks/ActivePayments', 
  express.raw({ type: 'application/json' }), 
  (req, res) => {
    const signature = req.headers['x-webhook-signature'];
    const rawBody = req.body; // Buffer do body original
    
    // Calcular HMAC sobre o body bruto (não o JSON parseado)
    const expectedSignature = crypto
      .createHmac('sha256', WEBHOOK_SECRET)
      .update(rawBody)
      .digest('hex');
    
    // Comparação segura contra timing attacks
    const isValid = crypto.timingSafeEqual(
      Buffer.from(signature || ''),
      Buffer.from(expectedSignature)
    );
    
    if (!isValid) {
      console.warn('Webhook rejeitado: assinatura inválida');
      return res.status(401).json({ error: 'Invalid signature' });
    }
    
    // Parse do JSON após validar assinatura
    const payload = JSON.parse(rawBody.toString());
    const { event, data } = payload;
    
    // Processar eventos de forma assíncrona
    processWebhookAsync(event, data);
    
    // Retornar 200 imediatamente
    res.status(200).json({ received: true });
});

async function processWebhookAsync(event, data) {
  // Verificar idempotência (evitar processar duplicatas)
  const processed = await checkIfAlreadyProcessed(data.chargeId);
  if (processed) return;
  
  switch (event) {
    case 'charge.paid':
      console.log('Pagamento confirmado:', data.chargeId);
      // Liberar produto/serviço
      break;
    case 'charge.cancelled':
      console.log('Cobrança cancelada:', data.chargeId);
      break;
  }
}

import hmac
import hashlib
from flask import Flask, request, jsonify

app = Flask(__name__)
WEBHOOK_SECRET = 'seu_webhook_secret'

def verify_signature(payload, signature, secret):
    expected = hmac.new(
        secret.encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

@app.route('/webhooks/ActivePayments', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Webhook-Signature')
    payload = request.get_data(as_text=True)
    
    if not verify_signature(payload, signature, WEBHOOK_SECRET):
        return jsonify({'error': 'Invalid signature'}), 401
    
    data = request.json
    event = data['event']
    
    if event == 'charge.paid':
        charge_id = data['data']['chargeId']
        print(f'Pagamento confirmado: {charge_id}')
        # Liberar produto/serviço
    
    return jsonify({'received': True}), 200