Deliver signed workspace events to your application.

import { veritas } from "@/lib/veritas";

const created = await veritas<{
  webhook: { id: string };
  secret: string;
}>("/webhooks", {
  method: "POST",
  body: JSON.stringify({
    url: "https://example.com/api/veritas-webhook",
    events: ["payment_link.paid", "verification.failed"],
  }),
});

const webhookId = created.webhook.id;
// Store created.secret in your server secret manager.

const webhooks = await veritas("/webhooks");

await veritas(`/webhooks/${webhookId}`, {
  method: "PATCH",
  body: JSON.stringify({ active: false }),
});

const rotated = await veritas<{ secret: string }>(
  `/webhooks/${webhookId}/rotate-secret`,
  { method: "POST" },
);

await veritas(`/webhooks/${webhookId}`, { method: "DELETE" });

import { veritas } from "@/lib/veritas";

const deliveries = await veritas(
  "/webhooks/webhook_id/deliveries?page=1&limit=50",
);

await veritas(
  "/webhooks/webhook_id/retry/failed_delivery_id",
  { method: "POST" },
);

import crypto from "node:crypto";

const webhookSecret = process.env.VERITAS_WEBHOOK_SECRET;
if (!webhookSecret) throw new Error("VERITAS_WEBHOOK_SECRET is required");

export async function POST(request: Request) {
  // Verify the exact bytes received from Veritas before parsing JSON.
  const rawRequestBody = Buffer.from(await request.arrayBuffer());
  const signatureHeader =
    request.headers.get("x-veritas-signature") ?? "";

  const expectedHex = crypto
    .createHmac("sha256", webhookSecret)
    .update(rawRequestBody)
    .digest("hex");
  const expected = `sha256=${expectedHex}`;
  const expectedBytes = Buffer.from(expected, "utf8");
  const receivedBytes = Buffer.from(signatureHeader, "utf8");

  const valid =
    expectedBytes.length === receivedBytes.length &&
    crypto.timingSafeEqual(expectedBytes, receivedBytes);

  if (!valid) return new Response("Invalid signature", { status: 401 });

  const event = JSON.parse(rawRequestBody.toString("utf8"));
  // Handle the event and record its order/delivery ID before side effects.
  console.log(event.event);

  return new Response(null, { status: 204 });
}