Webhooks

curl -X POST https://api.animam.ai/tenants/my-company/webhooks \
  -H "Authorization: Bearer ak_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-server.com/hooks/animam",
    "description": "CRM production",
    "events": ["submission.created", "submission.updated"],
    "piiFields": []
  }'

{
  "endpoint": {
    "id": "3f1c…",
    "url": "https://your-server.com/hooks/animam",
    "description": "CRM production",
    "events": ["submission.created", "submission.updated"],
    "enabled": true,
    "piiFields": [],
    "createdAt": "2026-07-30T09:12:44.000Z"
  },
  "secret": "9a1b…",
  "warning": "Store this secret — it will not be shown again."
}

{
  "event": "submission.created",
  "createdAt": "2026-07-30T11:24:50.912Z",
  "data": {
    "id": "b2d0…",
    "toolId": "9c31…",
    "toolType": "SUBMIT_FORM",
    "toolName": "contact_form",
    "channel": "web",
    "status": "NEW",
    "input": { "name": "Marie Durand", "email": "marie@example.com", "message": "Is the house still available?" },
    "result": { "success": true, "message": "Request captured." },
    "conversationId": "c-42",
    "messages": [
      { "role": "user", "content": "Is the house still available?" },
      { "role": "assistant", "content": "An offer may have been accepted since — let me have someone call you back." }
    ],
    "visitorUserId": null,
    "pageUrl": "https://your-site.com/listings/42",
    "createdAt": "2026-07-30T11:24:50.900Z"
  }
}

import hmac, hashlib, time

def verify(secret: str, raw_body: bytes, header: str, tolerance: int = 300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    t, v1 = int(parts["t"]), parts["v1"]
    if abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(
        secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, v1)

import { createHmac, timingSafeEqual } from 'node:crypto'

export function verify(secret, rawBody, header, tolerance = 300) {
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=')))
  const t = Number(parts.t)
  if (!t || Math.abs(Date.now() / 1000 - t) > tolerance) return false
  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex')
  const a = Buffer.from(expected, 'hex')
  const b = Buffer.from(parts.v1 ?? '', 'hex')
  return a.length === b.length && timingSafeEqual(a, b)
}