{
	"description": "Example Event Subscription",
	"token": "ep_1srOrx2ZWZBpBUvZwXKQmoEYga1",
	"event_types": null,
	"disabled": false,
	"url": "https://www.lithic.com/webhooks"
}

curl https://api.lithic.com/v1/event_subscriptions \
	-X POST \
	-H 'Authorization: YOUR_API_KEY' \
	-H 'accept: application/json' \
	-H 'content-type: application/json' \
	-d '  
{  
	"url": "https://www.lithic.com/webhooks",
	"description": "Subscription to all event types"
}  
'

{  
	"description": "Subscription to all event types",  
	"token": "ep_1srOrx2ZWZBpBUvZwXKQmoEYga1",  
	"event_types": null,  
	"disabled": false,  
	"url": "https://www.lithic.com/webhooks",
	"debugging_request_id": "2b736cba-a7a7-4036-8454-0d48a2cc15ed"  
}

curl https://api.lithic.com/v1/event_subscriptions \
	-H 'Authorization: YOUR_API_KEY' \
	-H 'accept: application/json'

{
  "data": [
    {
      "description": "First Event Subscription",
      "token": "ep_1srOrx2ZWZBpBUvZwXKQmoEYga1",
      "event_types": null,
      "disabled": false,
      "url": "https://www.lithic.com/webhooks"
    }
  ],
  "has_more": false
}

curl https://api.lithic.com/v1/event_subscriptions/ep_1srOrx2ZWZBpBUvZwXKQmoEYga1 \
 	-H 'Authorization: YOUR_API_KEY' \
 	-H 'accept: application/json'

{
	"description": "First Event Subscription",
	"token": "ep_1srOrx2ZWZBpBUvZwXKQmoEYga1",
	"event_types": null,
	"disabled": false,
	"url": "https://www.lithic.com/webhooks"
}

curl --request PATCH \
     --url https://api.lithic.com/v1/event_subscriptions/ep_1srOrx2ZWZBpBUvZwXKQmoEYga1 \
     --header 'Authorization: 1fe14193-bf47-4336-8366-f8680d6e9250' \
     --header 'accept: application/json' \
     --header 'content-type: application/json' \
     --data '
{
     "description": "Updated Event Subscription",
     "disabled": true,
     "url": "https://www.lithic.com/webhooks2"
}
'

{
  "description": "Updated Event Subscription",
  "token": "ep_1srOrx2ZWZBpBUvZwXKQmoEYga1",
  "event_types": null,
  "disabled": true,
  "url": "https://www.lithic.com/webhooks2"
}

curl https://api.lithic.com/v1/event_subscriptions/ep_1srOrx2ZWZBpBUvZwXKQmoEYga1 \
  -X DELETE \
  -H 'Authorization: YOUR_API_KEY' \
  -H 'content-type: application/json'

No Content

curl https://api.lithic.com/v1/event_subscriptions/ep_1srOrx2ZWZBpBUvZwXKQmoEYga1/recover \
  -X POST \
  -H 'Authorization: YOUR_API_KEY' \
  -H 'accept: application/json' \
  -H 'content-type: application/json' \
  -d '{
    "begin": "2023-01-01T14:15:00Z",
    "end": "2023-01-20T14:15:00Z"
}'

curl 'https://api.lithic.com/v1/event_subscriptions/ep_1srOrx2ZWZBpBUvZwXKQmoEYga1/replay_missing' \
  -X 'POST' \
  -H 'Authorization: YOUR_API_KEY' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "begin": "2023-01-01T14:15:00Z",
    "end": "2023-01-20T14:15:00Z"
}'

curl https://api.lithic.com/v1/event_subscriptions/ep_1srOrx2ZWZBpBUvZwXKQmoEYga1/secret \
  -H 'Authorization: YOUR_API_KEY' \
  -H 'accept: application/json'

{
	"key": "whsec_qhVbLvxSzK3OyH4baRAKDUGm3az3bduK"
}

curl https://api.lithic.com/v1/event_subscriptions/ep_1srOrx2ZWZBpBUvZwXKQmoEYga1/secret/rotate \
	-X POST \
	-H 'Authorization: YOUR_API_KEY' \
	-H 'content-type: application/json'

No Content

curl 'https://api.lithic.com/v1/events' \
 -H 'Authorization: YOUR_API_KEY' \
 -H 'accept: application/json'

{
	"data": [...],
	"has_more": false
}

curl https://api.lithic.com/v1/events/msg_1srOrx2ZWZBpBUvZwXKQmoEYga1 \
	-H 'Authorization: YOUR_API_KEY' \
	-H 'accept: application/json'

{
	"token": "msg_1srOrx2ZWZBpBUvZwXKQmoEYga1",  // this is the same as webhook-id in the header
	"event_type": "dispute.updated",
	"payload": {...},  // includes event_type
	"created": "2022:10:10T12:31:12Z"
}

curl -X POST https://api.lithic.com/v1/events/msg_1srOrx2ZWZBpBUvZwXKQmoEYga1/event_subscriptions/msg_123Orx2ZWZBpBUvZwXKQmoEYabc/resend \
	-H 'Authorization: YOUR_API_KEY' \
	-H 'accept: application/json'

signedContent = "${webhookId}.${webhookTimestamp}.${body}"

@app.post('/my-webhook-handler')
async def handler(request: Request):
    body = await request.body()
    secret = os.environ['LITHIC_WEBHOOK_SECRET']  # env var used by default; explicit here.
    payload = client.webhooks.unwrap(body, request.headers, secret)
    print(payload)

    return {'ok': True}

// with Express:
app.use('/webhooks/lithic', bodyParser.text({ type: '*/*' }), function (req, res) {
  const payload = lithic.webhooks.unwrap(req.body, req.headers, process.env['LITHIC_WEBHOOK_SECRET']); // env var used by default; explicit here.
  console.log(payload);
  res.json({ ok: true });
});

// with Next.js (app router):
export default async function POST(req) {
  const body = await req.text(); // if you're using the pages router, you will need this trick: https://vancelucas.com/blog/how-to-access-raw-body-data-with-next-js/
  const payload = lithic.webhooks.unwrap(body, req.headers, process.env['LITHIC_WEBHOOK_SECRET']); // env var used by default; explicit here.
  console.log(payload);
  return NextResponse.json({ ok: true });
}

import base64
import hashlib
import hmac
import json
import typing as t
from datetime import datetime, timedelta, timezone
from math import floor


class WebhookVerificationError(Exception):
    pass


def hmac_data(key: bytes, data: bytes) -> bytes:
    return hmac.new(key, data, hashlib.sha256).digest()

  
def verify_timestamp(timestamp_header: str) -> str:
    webhook_tolerance = timedelta(minutes=5)
    now = datetime.now(tz=timezone.utc)
    try:
        timestamp = datetime.fromtimestamp(float(timestamp_header), tz=timezone.utc)
    except Exception:
        raise WebhookVerificationError("Invalid Signature Headers")

    if timestamp < (now - webhook_tolerance):
        raise WebhookVerificationError("Message timestamp too old")
    if timestamp > (now + webhook_tolerance):
        raise WebhookVerificationError("Message timestamp too new")
    return timestamp_header  


def sign_webhook(whsecret: bytes, msg_id: str, timestamp: str, data: str) -> str:
    to_sign = f"{msg_id}.{timestamp}.{data}".encode()
    signature = hmac_data(whsecret, to_sign)
    return f"v1,{base64.b64encode(signature).decode('utf-8')}"
  

def verify_webhook(whsecret: str, data: bytes, headers: t.Dict[str, str]) -> bool:
    SECRET_PREFIX = "whsec_"
    if whsecret.startswith(SECRET_PREFIX):
        whsecret = whsecret[len(SECRET_PREFIX) :]
    whsecret = base64.b64decode(whsecret)

    headers = {k.lower(): v for (k, v) in headers.items()}
    msg_id = headers.get("webhook-id")
    msg_signature = headers.get("webhook-signature")
    msg_timestamp = headers.get("webhook-timestamp")

    if not (msg_id and msg_timestamp and msg_signature):
        raise WebhookVerificationError("Missing required headers")
    
    timestamp = verify_timestamp(msg_timestamp)
    expected_sig = base64.b64decode(sign_webhook(whsecret, msg_id, timestamp, data).split(",")[1])
    
    # Signature header can contain multiple signatures delimited by spaces
    passed_sigs = msg_signature.split(" ")

    for versioned_sig in passed_sigs:
        (version, signature) = versioned_sig.split(",")
        # Only verify prefix v1
        if version != "v1":
            continue
        sig_bytes = base64.b64decode(signature)
        if hmac.compare_digest(expected_sig, sig_bytes):
            return True

    raise False

const WEBHOOK_TOLERANCE_IN_SECONDS = 5 * 60; // 5 minutes

class ExtendableError extends Error {
    constructor(message: any) {
        super(message);
        Object.setPrototypeOf(this, ExtendableError.prototype);
        this.name = "ExtendableError";
        this.stack = new Error(message).stack;
    }
}

export class WebhookVerificationError extends ExtendableError {
    constructor(message: string) {
        super(message);
        Object.setPrototypeOf(this, WebhookVerificationError.prototype);
        this.name = "WebhookVerificationError";
    }
}

export interface WebhookRequiredHeaders {
    "webhook-id": string;
    "webhook-timestamp": string;
    "webhook-signature": string;
}

export interface WebhookOptions {
    format?: "raw";
}

/** Make an assertion, if not `true`, then throw. */
function assert(expr: unknown, msg = ""): asserts expr {
    if (!expr) {
        throw new Error(msg);
    }
}

/** Compare to array buffers or data views in a way that timing based attacks
 * cannot gain information about the platform. */
function timingSafeEqual(
    a: ArrayBufferView | ArrayBufferLike | DataView,
    b: ArrayBufferView | ArrayBufferLike | DataView
): boolean {
    if (a.byteLength !== b.byteLength) {
        return false;
    }
    if (!(a instanceof DataView)) {
        a = new DataView(ArrayBuffer.isView(a) ? a.buffer : a);
    }
    if (!(b instanceof DataView)) {
        b = new DataView(ArrayBuffer.isView(b) ? b.buffer : b);
    }
    assert(a instanceof DataView);
    assert(b instanceof DataView);
    const length = a.byteLength;
    let out = 0;
    let i = -1;
    while (++i < length) {
        out |= a.getUint8(i) ^ b.getUint8(i);
    }
    return out === 0;
}

export class Webhook {
    private static prefix = "whsec_";
    private readonly key: Uint8Array;

    constructor(secret: string | Uint8Array, options?: WebhookOptions) {
        if (!secret) {
            throw new Error("Secret can't be empty.");
        }
        if (options?.format === "raw") {
            if (secret instanceof Uint8Array) {
                this.key = secret;
            } else {
                this.key = Uint8Array.from(secret, (c) => c.charCodeAt(0));
            }
        } else {
            if (typeof secret !== "string") {
                throw new Error("Expected secret to be of type string");
            }
            if (secret.startsWith(Webhook.prefix)) {
                secret = secret.substring(Webhook.prefix.length);
            }
            this.key = base64.decode(secret);
        }
    }

    public verify(
        payload: string,
        headers_:
            | WebhookRequiredHeaders
            | Record<string, string>
    ): unknown {
        const headers: Record<string, string> = {};
        for (const key of Object.keys(headers_)) {
            headers[key.toLowerCase()] = (headers_ as Record<string, string>)[key];
        }

        let msgId = headers["webhook-id"];
        let msgSignature = headers["webhook-signature"];
        let msgTimestamp = headers["webhook-timestamp"];

        if (!msgSignature || !msgId || !msgTimestamp) {
            throw new WebhookVerificationError("Missing required headers");
        }

        const timestamp = this.verifyTimestamp(msgTimestamp);

        const computedSignature = this.sign(msgId, timestamp, payload);
        const expectedSignature = computedSignature.split(",")[1];

        const passedSignatures = msgSignature.split(" ");

        const encoder = new globalThis.TextEncoder();
        for (const versionedSignature of passedSignatures) {
            const [version, signature] = versionedSignature.split(",");
            if (version !== "v1") {
                continue;
            }

            if (timingSafeEqual(encoder.encode(signature), encoder.encode(expectedSignature))) {
                return JSON.parse(payload);
            }
        }
        throw new WebhookVerificationError("No matching signature found");
    }

    public sign(msgId: string, timestamp: Date, payload: string): string {
        const encoder = new TextEncoder();
        const toSign = encoder.encode(`${msgId}.${timestamp.getTime() / 1000}.${payload}`);
        const expectedSignature = base64.encode(sha256.hmac(this.key, toSign));
        return `v1,${expectedSignature}`;
    }

    private verifyTimestamp(timestampHeader: string): Date {
        const now = Math.floor(Date.now() / 1000);
        const timestamp = parseInt(timestampHeader, 10);
        if (isNaN(timestamp)) {
            throw new WebhookVerificationError("Invalid Signature Headers");
        }

        if (now - timestamp > WEBHOOK_TOLERANCE_IN_SECONDS) {
            throw new WebhookVerificationError("Message timestamp too old");
        }
        if (timestamp > now + WEBHOOK_TOLERANCE_IN_SECONDS) {
            throw new WebhookVerificationError("Message timestamp too new");
        }
        return new Date(timestamp * 1000);
    }
}

{
    "created": "2023-07-18T00:45:37.195Z",
    "event_subscription_token": "ep_1srOrx2ZWZBpBUvZwXKQmoEYga1",
    "event_token": "msg_1srOrx2ZWZBpBUvZwXKQmoEYga1",
    "response": "string",
    "response_status_code": 400,
    "status": "FAILED",
    "url": "string",
    "token": "atmpt_1srOrx2ZWZBpBUvZwXKQmoEYga2"
}