┌─────────────────────┐     ┌─────────────────────┐     ┌─────────────────────┐
│    Evento Ocorre    │────>│     Ecosys Auto      │────>│   Seu Servidor      │
│  (ex: veículo       │     │   envia POST        │     │   processa e        │
│   vendido)          │     │   para sua URL      │     │   responde 200 OK   │
└─────────────────────┘     └─────────────────────┘     └─────────────────────┘

curl -X GET https://api.shopcar.com.br/v1/webhooks \
  -H "Authorization: Bearer ea_live_sua_chave_aqui"

{
  "success": true,
  "data": [
    {
      "id": "wh_abc123def456",
      "url": "https://seu-app.com/api/webhooks/ecosys-auto",
      "events": [
        "vehicle.created",
        "vehicle.updated",
        "activity.due_soon",
        "activity.overdue"
      ],
      "active": true,
      "created_at": "2026-01-10T10:00:00Z",
      "last_triggered_at": "2026-02-04T14:30:00Z",
      "success_rate": 98.5,
      "total_deliveries": 127,
      "failed_deliveries": 2
    }
  ]
}

curl -X POST https://api.shopcar.com.br/v1/webhooks \
  -H "Authorization: Bearer ea_live_sua_chave_aqui" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://seu-app.com/api/webhooks/ecosys-auto",
    "events": [
      "vehicle.created",
      "vehicle.updated",
      "vehicle.sold",
      "activity.created",
      "activity.completed",
      "activity.due_soon",
      "activity.overdue",
      "client.created",
      "deal.won",
      "deal.lost"
    ],
    "description": "Integração com portal de anúncios"
  }'

{
  "success": true,
  "data": {
    "id": "wh_new123abc456",
    "url": "https://seu-app.com/api/webhooks/ecosys-auto",
    "events": ["vehicle.created", "vehicle.updated", "..."],
    "active": true,
    "secret": "whsec_AbCdEfGhIjKlMnOpQrStUvWxYz123456789",
    "created_at": "2026-02-04T10:30:00Z"
  }
}

curl -X PUT https://api.shopcar.com.br/v1/webhooks/wh_abc123def456 \
  -H "Authorization: Bearer ea_live_sua_chave_aqui" \
  -H "Content-Type: application/json" \
  -d '{
    "events": ["vehicle.created", "vehicle.updated"],
    "active": true
  }'

{
  "success": true,
  "data": {
    "id": "wh_abc123def456",
    "events": ["vehicle.created", "vehicle.updated"],
    "active": true,
    "updated_at": "2026-02-04T15:00:00Z"
  }
}

curl -X DELETE https://api.shopcar.com.br/v1/webhooks/wh_abc123def456 \
  -H "Authorization: Bearer ea_live_sua_chave_aqui"

{
  "success": true,
  "data": {
    "id": "wh_abc123def456",
    "deleted": true
  }
}

{
  "id": "evt_abc123def456",
  "type": "vehicle.created",
  "api_version": "v1",
  "created_at": "2026-02-04T14:30:00Z",
  "data": {
    "object": {
      "id": "veh_xyz789",
      "title": "Honda Civic EXL 2.0 2024",
      "brand": "Honda",
      "model": "Civic",
      "price": 142900.00,
      "phase": "recebido",
      "status": "disponivel",
      "client": {
        "id": "cli_abc123",
        "name": "João da Silva"
      },
      "created_at": "2026-02-04T14:30:00Z"
    },
    "previous_attributes": null
  },
  "team_id": "team_xyz789",
  "webhook_id": "wh_abc123def456"
}

{
  "id": "evt_update123",
  "type": "vehicle.updated",
  "data": {
    "object": {
      "id": "veh_xyz789",
      "phase": "em-vitrine",
      "price": 139900.00
    },
    "previous_attributes": {
      "phase": "recebido",
      "price": 142900.00
    }
  }
}

import crypto from 'crypto';
import express from 'express';

const app = express();
const WEBHOOK_SECRET = process.env.ECOSYS_AUTO_WEBHOOK_SECRET;

app.use('/webhook', express.raw({ type: 'application/json' }));

app.post('/webhook', (req, res) => {
  const signature = req.headers['x-ecosys-auto-signature'];
  const timestamp = req.headers['x-ecosys-auto-timestamp'];
  const payload = req.body.toString();

  // Verificar timestamp (previne replay attacks)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) {
    return res.status(401).json({ error: 'Timestamp too old' });
  }

  // Calcular assinatura esperada
  const signedPayload = `${timestamp}.${payload}`;
  const expectedSignature = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(signedPayload)
    .digest('hex');

  // Comparação segura
  if (!crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  )) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // Processar evento
  const event = JSON.parse(payload);
  console.log(`Evento recebido: ${event.type}`);

  switch (event.type) {
    case 'vehicle.created':
      handleVehicleCreated(event.data.object);
      break;
    case 'activity.overdue':
      handleActivityOverdue(event.data.object);
      break;
    case 'deal.won':
      handleDealWon(event.data.object);
      break;
  }

  res.status(200).json({ received: true });
});

function handleVehicleCreated(vehicleData) {
  console.log(`Novo veículo: ${vehicleData.title}`);
  // Publicar no portal de anúncios, enviar notificação, etc.
}

function handleActivityOverdue(activity) {
  console.log(`Atividade atrasada: ${activity.title}`);
  // Enviar alerta, criar ticket, etc.
}

function handleDealWon(deal) {
  console.log(`Venda concretizada: ${deal.title} - R$ ${deal.value}`);
  // Atualizar métricas, gerar contrato, etc.
}

import hmac
import hashlib
import time
from flask import Flask, request, jsonify

app = Flask(__name__)
WEBHOOK_SECRET = os.environ['ECOSYS_AUTO_WEBHOOK_SECRET']

@app.route('/webhook', methods=['POST'])
def webhook():
    signature = request.headers.get('X-Ecosys-Auto-Signature')
    timestamp = request.headers.get('X-Ecosys-Auto-Timestamp')
    payload = request.get_data(as_text=True)

    # Verificar timestamp
    now = int(time.time())
    if abs(now - int(timestamp)) > 300:
        return jsonify({'error': 'Timestamp too old'}), 401

    # Calcular assinatura
    signed_payload = f"{timestamp}.{payload}"
    expected_signature = hmac.new(
        WEBHOOK_SECRET.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()

    # Comparação segura
    if not hmac.compare_digest(signature, expected_signature):
        return jsonify({'error': 'Invalid signature'}), 401

    # Processar evento
    event = request.json
    print(f"Evento recebido: {event['type']}")

    if event['type'] == 'vehicle.created':
        handle_vehicle_created(event['data']['object'])
    elif event['type'] == 'activity.overdue':
        handle_activity_overdue(event['data']['object'])

    return jsonify({'received': True}), 200