API Dokümantasyonu

POST https://example.com/synaptix
Content-Type: application/json
User-Agent: Synaptix-Webhooks/1.0
X-Synaptix-Event: request.created
X-Synaptix-Delivery: 6d0f1c2e-6a1f-4f4a-9a8d-2f7c5b1ea91b
X-Synaptix-Signature: sha256=<lowercase hex>

{
  "event": "request.created",
  "delivery_id": "6d0f1c2e-6a1f-4f4a-9a8d-2f7c5b1ea91b",
  "created_at": "2026-09-09T12:04:11.482Z",
  "bot_id": "1f0b6d5e-2a44-4c9f-8b21-9e6a2f3c7d10",
  "data": {
    "id": "9c1a7f22-4d63-4b0e-9d61-3a8f5c2b7e04",
    "request_type": "lead_collection",
    "status": "new",
    "message": "Fiyat listesi alabilir miyim?",
    "visitor_name": "Ada Yılmaz",
    "visitor_email": "ada@example.com",
    "visitor_phone": null,
    "source_page_host": "example.com",
    "created_at": "2026-09-09T12:04:11.101Z"
  }
}

{
  "id": "2b7d4f10-9c33-4a6e-8f52-71c0d9ab3e64",
  "request_id": "9c1a7f22-4d63-4b0e-9d61-3a8f5c2b7e04",
  "status": "pending",
  "message": "Cuma 14:30 için randevu",
  "visitor_name": "Ada Yılmaz",
  "visitor_email": "ada@example.com",
  "visitor_phone": "+90 555 000 00 00",
  "appointment_date": "2026-09-11",
  "appointment_time": "14:30",
  "appointment_at": "2026-09-11T11:30:00Z",
  "source_page_host": "example.com",
  "created_at": "2026-09-09T12:04:11.101Z"
}

const crypto = require('crypto');
const express = require('express');
const app = express();

// express.raw: the signature covers the bytes we sent, so the handler
// must see the raw body and not a re-serialised object.
app.post('/synaptix', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', process.env.SYNAPTIX_WEBHOOK_SECRET)
    .update(req.body)
    .digest('hex');

  const received = req.get('X-Synaptix-Signature') || '';
  const a = Buffer.from(expected, 'utf8');
  const b = Buffer.from(received, 'utf8');

  // timingSafeEqual throws when the lengths differ, so length is checked
  // first - and it is checked in constant time for equal-length input.
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).send('invalid signature');
  }

  const payload = JSON.parse(req.body.toString('utf8'));
  // payload.event, payload.delivery_id, payload.bot_id, payload.data
  res.sendStatus(200);
});

import hashlib
import hmac
import os
from flask import Flask, request

app = Flask(__name__)
SECRET = os.environ["SYNAPTIX_WEBHOOK_SECRET"].encode("utf-8")

@app.post("/synaptix")
def synaptix():
    raw = request.get_data()  # bytes, exactly as received
    expected = "sha256=" + hmac.new(SECRET, raw, hashlib.sha256).hexdigest()
    received = request.headers.get("X-Synaptix-Signature", "")

    # compare_digest is constant time and safe on unequal lengths.
    if not hmac.compare_digest(expected, received):
        return "invalid signature", 401

    payload = request.get_json()
    # payload["event"], payload["delivery_id"], payload["bot_id"], payload["data"]
    return "", 200