Webhooks

curl -X POST "https://api.fitsociety.io/public/v1/webhooks" \
  -H "Authorization: Bearer $FITSOCIETY_ACCESS_TOKEN" \
  -H "Idempotency-Key: webhook-create-crm-sync-20260714" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "CRM sync",
    "url": "https://example.com/fitsociety/webhooks",
    "events": ["client.created", "client.updated"]
  }'

const response = await fetch("https://api.fitsociety.io/public/v1/webhooks", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.FITSOCIETY_ACCESS_TOKEN}`,
    "Idempotency-Key": "webhook-create-crm-sync-20260714",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    name: "CRM sync",
    url: "https://example.com/fitsociety/webhooks",
    events: ["client.created", "client.updated"],
  }),
});

const body = await response.json();
if (response.status === 201) {
  // signingSecret is returned exactly once. Store it securely.
  console.log(
    "Store this signing secret:",
    body.data.subscription.signingSecret,
  );
}

import os
import requests

response = requests.post(
    "https://api.fitsociety.io/public/v1/webhooks",
    headers={
        "Authorization": f"Bearer {os.environ['FITSOCIETY_ACCESS_TOKEN']}",
        "Idempotency-Key": "webhook-create-crm-sync-20260714",
    },
    json={
        "name": "CRM sync",
        "url": "https://example.com/fitsociety/webhooks",
        "events": ["client.created", "client.updated"],
    },
)
response.raise_for_status()

body = response.json()
if response.status_code == 201:
    # signingSecret is returned exactly once. Store it securely.
    print("Store this signing secret:", body["data"]["subscription"]["signingSecret"])

const crypto = require("crypto");
const express = require("express");

const app = express();
app.use(express.json());

// The one-time signingSecret (whsec_...) from the webhook create response.
const WEBHOOK_SECRET = process.env.FITSOCIETY_WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 300;

// Canonical JSON: recursively sort object keys, keep array order.
// This matches FITsociety's stableJson exactly.
function stableJson(value) {
  if (value === null || typeof value !== "object") {
    return JSON.stringify(value);
  }
  if (Array.isArray(value)) {
    return `[${value.map((item) => stableJson(item)).join(",")}]`;
  }
  return `{${Object.keys(value)
    .sort()
    .map((key) => `${JSON.stringify(key)}:${stableJson(value[key])}`)
    .join(",")}}`;
}

app.post("/fitsociety/webhooks", (req, res) => {
  const timestamp = req.get("X-FITsociety-Webhook-Timestamp") || "";
  const deliveryId = req.get("X-FITsociety-Webhook-Delivery") || "";
  const signatureHeader = req.get("X-FITsociety-Webhook-Signature") || "";
  const eventId = req.body?.id || "";

  // 1. Reject stale or missing timestamps to limit replay windows.
  const nowSeconds = Math.floor(Date.now() / 1000);
  if (
    !/^\d+$/.test(timestamp) ||
    Math.abs(nowSeconds - Number(timestamp)) > TOLERANCE_SECONDS
  ) {
    return res.status(400).send("stale or missing timestamp");
  }

  // 2. Rebuild the signed string:
  //    timestamp.deliveryId.eventId.stableJson(payload)
  const signedPayload = [
    timestamp,
    deliveryId,
    eventId,
    stableJson(req.body),
  ].join(".");
  const expected = `v1=${crypto
    .createHmac("sha256", WEBHOOK_SECRET)
    .update(signedPayload)
    .digest("hex")}`;

  // 3. Compare in constant time.
  const expectedBuffer = Buffer.from(expected);
  const receivedBuffer = Buffer.from(signatureHeader);
  const valid =
    expectedBuffer.length === receivedBuffer.length &&
    crypto.timingSafeEqual(expectedBuffer, receivedBuffer);
  if (!valid) {
    return res.status(401).send("invalid signature");
  }

  // 4. Deduplicate on the delivery id, then acknowledge with a 2xx quickly.
  console.log(
    `Verified ${req.get("X-FITsociety-Webhook-Event")} delivery ${deliveryId}`,
  );
  return res.status(200).json({ ok: true });
});

app.listen(3000);

import hashlib
import hmac
import json
import os
import time

from flask import Flask, jsonify, request

app = Flask(__name__)

# The one-time signingSecret (whsec_...) from the webhook create response.
WEBHOOK_SECRET = os.environ["FITSOCIETY_WEBHOOK_SECRET"]
TOLERANCE_SECONDS = 300


def stable_json(value):
    """Canonical JSON: recursively sort object keys, keep array order.

    This matches FITsociety's stableJson exactly.
    """
    if isinstance(value, dict):
        return (
            "{"
            + ",".join(
                json.dumps(key, ensure_ascii=False, separators=(",", ":"))
                + ":"
                + stable_json(value[key])
                for key in sorted(value.keys())
            )
            + "}"
        )
    if isinstance(value, list):
        return "[" + ",".join(stable_json(item) for item in value) + "]"
    return json.dumps(value, ensure_ascii=False, separators=(",", ":"))


@app.post("/fitsociety/webhooks")
def fitsociety_webhook():
    timestamp = request.headers.get("X-FITsociety-Webhook-Timestamp", "")
    delivery_id = request.headers.get("X-FITsociety-Webhook-Delivery", "")
    signature_header = request.headers.get("X-FITsociety-Webhook-Signature", "")
    payload = request.get_json(silent=True) or {}
    event_id = payload.get("id", "")

    # 1. Reject stale or missing timestamps to limit replay windows.
    if (
        not timestamp.isdigit()
        or abs(int(time.time()) - int(timestamp)) > TOLERANCE_SECONDS
    ):
        return "stale or missing timestamp", 400

    # 2. Rebuild the signed string:
    #    timestamp.deliveryId.eventId.stableJson(payload)
    signed_payload = ".".join(
        [timestamp, delivery_id, event_id, stable_json(payload)]
    )
    expected = "v1=" + hmac.new(
        WEBHOOK_SECRET.encode("utf-8"),
        signed_payload.encode("utf-8"),
        hashlib.sha256,
    ).hexdigest()

    # 3. Compare in constant time.
    if not hmac.compare_digest(expected, signature_header):
        return "invalid signature", 401

    # 4. Deduplicate on the delivery id, then acknowledge with a 2xx quickly.
    event_type = request.headers.get("X-FITsociety-Webhook-Event", "")
    print(f"Verified {event_type} delivery {delivery_id}")
    return jsonify(ok=True), 200

curl -H "Authorization: Bearer $FITSOCIETY_ACCESS_TOKEN" \
  "https://api.fitsociety.io/public/v1/webhooks/deliveries?subscriptionId=66f7b8b1e13c8d25f4d3d90a&page=1&limit=50"

const query = new URLSearchParams({
  subscriptionId: "66f7b8b1e13c8d25f4d3d90a",
  page: "1",
  limit: "50",
});

const response = await fetch(
  `https://api.fitsociety.io/public/v1/webhooks/deliveries?${query}`,
  {
    headers: {
      Authorization: `Bearer ${process.env.FITSOCIETY_ACCESS_TOKEN}`,
    },
  },
);

const body = await response.json();
for (const delivery of body.data.deliveries) {
  console.log(delivery.id, delivery.eventType, delivery.status);
}

import os
import requests

response = requests.get(
    "https://api.fitsociety.io/public/v1/webhooks/deliveries",
    headers={"Authorization": f"Bearer {os.environ['FITSOCIETY_ACCESS_TOKEN']}"},
    params={
        "subscriptionId": "66f7b8b1e13c8d25f4d3d90a",
        "page": 1,
        "limit": 50,
    },
)
response.raise_for_status()

body = response.json()
for delivery in body["data"]["deliveries"]:
    print(delivery["id"], delivery["eventType"], delivery["status"])