Webhooks

curl -X POST https://api.escapelife.ai/v1/webhooks \
  -H "X-API-Key: sk_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-server.com/webhooks/escapelife",
    "events": "*",
    "description": "Production webhook"
  }'

{
  "id": "whe_a1b2c3d4e5f6",
  "property_id": "pty_xyz",
  "url": "https://your-server.com/webhooks/escapelife",
  "secret": "3f8a2b1c9d4e...",
  "events": "*",
  "is_active": true,
  "created_at": "2026-03-16T12:00:00Z"
}

POST https://your-server.com/webhooks/escapelife
Content-Type: application/json
EscapeLife-Signature: t=1710000000,v1=abc123...

{
  "id": "evt_9xk2mp7q",
  "type": "guest.intent.created",
  "property_id": "pty_xyz123",
  "created_at": "2026-03-15T10:00:00Z",
  "data": {
    "guest_id": "gst_01H",
    "channel": "voice",
    "intent": "book_experience",
    "context": {
      "property_id": "pty_xyz123",
      "preferred_time": "2026-03-20T20:00:00Z"
    }
  }
}

import crypto from "crypto";

export async function POST(req: Request) {
  const body = await req.text();
  const sig = req.headers.get("EscapeLife-Signature") ?? "";
  const secret = process.env.ESCAPELIFE_WEBHOOK_SECRET!;

  const [tPart, v1Part] = sig.split(",");
  const timestamp = tPart.replace("t=", "");
  const received = v1Part.replace("v1=", "");

  const payload = `${timestamp}.${body}`;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(payload)
    .digest("hex");

  if (!crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected))) {
    return new Response("Invalid signature", { status: 400 });
  }

  const event = JSON.parse(body);
  // handle event...
  return new Response("OK");
}

import hmac, hashlib
from fastapi import Request, HTTPException

async def verify_webhook(request: Request, secret: str) -> dict:
    body = await request.body()
    sig = request.headers.get("EscapeLife-Signature", "")

    parts = dict(p.split("=", 1) for p in sig.split(","))
    timestamp = parts.get("t", "")
    received = parts.get("v1", "")

    payload = f"{timestamp}.{body.decode()}"
    expected = hmac.new(secret.encode(), payload.encode(), hashlib.sha256).hexdigest()

    if not hmac.compare_digest(received, expected):
        raise HTTPException(status_code=400, detail="Invalid signature")

    return json.loads(body)