┌─────────────────────┐     ┌─────────────────────┐     ┌─────────────────────┐
│    Evento Ocorre    │────>│     Ecosys Auto      │────>│   Seu Servidor      │
│  (ex: negócio       │     │   envia POST        │     │   processa e        │
│   ganho)            │     │   para sua URL      │     │   responde 200 OK   │
└─────────────────────┘     └─────────────────────┘     └─────────────────────┘

{
  "id": "evt_abc123def456",
  "type": "vehicle.created",
  "api_version": "v1",
  "created_at": "2026-02-04T14:30:00Z",
  "data": {
    "object": {
      "id": "uuid-do-veiculo",
      "title": "Honda Civic EXL 2.0 2024",
      "brand": "Honda",
      "model": "Civic",
      "price": 142900.00,
      "phase": "entrada",
      "status": "ativo",
      "created_at": "2026-02-04T14:30:00Z"
    },
    "previous_attributes": null
  },
  "team_id": "uuid-do-time",
  "webhook_id": "uuid-do-webhook"
}

{
  "id": "evt_update123",
  "type": "vehicle.updated",
  "data": {
    "object": {
      "id": "uuid-do-veiculo",
      "phase": "em-vitrine",
      "price": 139900.00
    },
    "previous_attributes": {
      "phase": "entrada",
      "price": 142900.00
    }
  }
}

import crypto from 'crypto';
import express from 'express';

const app = express();
const WEBHOOK_SECRET = process.env.ECOSYS_AUTO_WEBHOOK_SECRET;

app.use('/webhook', express.raw({ type: 'application/json' }));

app.post('/webhook', (req, res) => {
  const signature = req.headers['x-ecosys-auto-signature'];
  const timestamp = req.headers['x-ecosys-auto-timestamp'];
  const payload = req.body.toString();

  // Verificar timestamp (previne replay attacks — janela de 5 minutos)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) {
    return res.status(401).json({ error: 'Timestamp expirado' });
  }

  // Calcular assinatura esperada
  const signedPayload = `${timestamp}.${payload}`;
  const expectedSignature = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(signedPayload)
    .digest('hex');

  // Comparação segura (previne timing attacks)
  if (!crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  )) {
    return res.status(401).json({ error: 'Assinatura inválida' });
  }

  // Processar evento de forma assíncrona
  const event = JSON.parse(payload);

  switch (event.type) {
    case 'vehicle.created':
      // Publicar no portal de anúncios, enviar notificação, etc.
      break;
    case 'deal.won':
      // Atualizar métricas, gerar contrato, etc.
      break;
    case 'activity.overdue':
      // Enviar alerta, criar ticket, etc.
      break;
  }

  // Responda RAPIDAMENTE com 200 OK
  res.status(200).json({ received: true });
});

import hmac
import hashlib
import time
import os
from flask import Flask, request, jsonify

app = Flask(__name__)
WEBHOOK_SECRET = os.environ['ECOSYS_AUTO_WEBHOOK_SECRET']

@app.route('/webhook', methods=['POST'])
def webhook():
    signature = request.headers.get('X-Ecosys-Auto-Signature')
    timestamp = request.headers.get('X-Ecosys-Auto-Timestamp')
    payload = request.get_data(as_text=True)

    # Verificar timestamp
    now = int(time.time())
    if abs(now - int(timestamp)) > 300:
        return jsonify({'error': 'Timestamp expirado'}), 401

    # Calcular assinatura
    signed_payload = f"{timestamp}.{payload}"
    expected_signature = hmac.new(
        WEBHOOK_SECRET.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()

    # Comparação segura
    if not hmac.compare_digest(signature, expected_signature):
        return jsonify({'error': 'Assinatura inválida'}), 401

    event = request.json
    # Processar evento...

    return jsonify({'received': True}), 200

GET    /api/v1/webhooks         — Listar webhooks configurados
POST   /api/v1/webhooks         — Criar webhook
PUT    /api/v1/webhooks/:id     — Atualizar webhook
DELETE /api/v1/webhooks/:id     — Remover webhook