Webhooks

POST /your/endpoint HTTP/1.1
Content-Type: application/json
X-Atrix-Event: deal.won
X-Atrix-Signature: t=1761552000,v1=5f2b…

{
  "event": "deal.won",
  "payload": {
    "dealId": "deal_1",
    "title": "Brand refresh for Northwind",
    "companyName": "Northwind",
    "stage": "WON",
    "fromStage": "PROPOSED",
    "ownerId": "mem_ines",
    "ownerName": "Ines Carvalho",
    "href": "/dashboard/customers/deals/deal_1",
    "_rule": {
      "id": "rul_1",
      "name": "Tell finance"
    },
    "_workspace": {
      "name": "Acme"
    }
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(secret: string, header: string, rawBody: string) {
  const t = /t=(\d+)/.exec(header)?.[1];
  const v1 = /v1=([0-9a-f]+)/.exec(header)?.[1];
  if (!t || !v1) return false;
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  return expected.length === v1.length && timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}