Integração com webhook

curl -X POST https://admin.kycert.com.br/api/v1/bureau/runs \
  -H "x-api-key: sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "template_id": "550e8400-e29b-41d4-a716-446655440000",
    "subject": {
      "type": "pf",
      "doc": "12345678901",
      "name": "João Silva"
    },
    "external_id": "cust_abc123"
  }'

const res = await fetch('https://admin.kycert.com.br/api/v1/bureau/runs', {
  method: 'POST',
  headers: {
    'x-api-key': process.env.KYCERT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    template_id: '550e8400-e29b-41d4-a716-446655440000',
    subject: { type: 'pf', doc: '12345678901', name: 'João Silva' },
    external_id: 'cust_abc123',
  }),
})

if (!res.ok) {
  const err = await res.json()
  throw new Error(`kycert error: ${err.error.code} — ${err.error.message}`)
}

const { run_id } = await res.json()
console.log(`Run criado: ${run_id}`)

import os, requests

response = requests.post(
    'https://admin.kycert.com.br/api/v1/bureau/runs',
    headers={
        'x-api-key': os.environ['KYCERT_API_KEY'],
        'Content-Type': 'application/json',
    },
    json={
        'template_id': '550e8400-e29b-41d4-a716-446655440000',
        'subject': {'type': 'pf', 'doc': '12345678901', 'name': 'João Silva'},
        'external_id': 'cust_abc123',
    }
)

if not response.ok:
    err = response.json()
    raise Exception(f"kycert error: {err['error']['code']} — {err['error']['message']}")

data = response.json()
print(f"Run criado: {data['run_id']}")

import express from 'express'
import crypto from 'crypto'

function verifyKycertSignature(
  payload: Buffer,
  signature: string,
  secret: string,
): boolean {
  // Formato: "t=1234567890,v1=abc123..."
  const parts = Object.fromEntries(
    signature.split(',').map(p => p.split('=') as [string, string])
  )
  const timestamp = parts['t']
  const expected  = parts['v1']
  if (!timestamp || !expected) return false

  // Rejeitar eventos com mais de 5 minutos de diferença
  if (Math.abs(Date.now() / 1000 - parseInt(timestamp)) > 300) return false

  const computed = crypto
    .createHmac('sha256', secret)           // secret é raw string, não hex-decoded
    .update(`${timestamp}.${payload.toString()}`, 'utf8')
    .digest('hex')

  if (computed.length !== expected.length) return false
  return crypto.timingSafeEqual(
    Buffer.from(computed, 'hex'),
    Buffer.from(expected, 'hex'),
  )
}

const app = express()

app.post(
  '/webhooks/kycert',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['kycert-signature'] as string
    const secret    = process.env.KYCERT_WEBHOOK_SECRET!

    if (!verifyKycertSignature(req.body, signature, secret)) {
      return res.sendStatus(401)
    }

    // Responda 200 imediatamente — processe de forma assíncrona
    res.sendStatus(200)

    const event = JSON.parse(req.body.toString())
    setImmediate(() => handleKycertEvent(event))
  }
)

async function handleKycertEvent(event: Record<string, unknown>) {
  if (event['event'] === 'run.completed') {
    const data = event['data'] as Record<string, unknown>
    const { decision, risk_band, external_id } = data as {
      decision: string
      risk_band: string
      external_id: string
    }
    console.log(`Run ${external_id}: ${decision} (${risk_band})`)
    // ex: atualizar status do cliente no banco de dados
  }
}

import hmac, hashlib, time, json
from flask import Flask, request, abort

app = Flask(__name__)

def verify_kycert_signature(payload: bytes, signature: str, secret: str) -> bool:
    parts = dict(p.split('=', 1) for p in signature.split(','))
    ts  = parts.get('t', '')
    sig = parts.get('v1', '')
    if not ts or not sig:
        return False
    # Rejeitar eventos com mais de 5 minutos
    if abs(time.time() - int(ts)) > 300:
        return False
    expected = hmac.new(
        secret.encode(),                    # secret é raw string, não hex-decoded
        f"{ts}.{payload.decode()}".encode(),
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, sig)

@app.route('/webhooks/kycert', methods=['POST'])
def webhook():
    import os
    signature = request.headers.get('kycert-signature', '')
    secret    = os.environ['KYCERT_WEBHOOK_SECRET']

    if not verify_kycert_signature(request.data, signature, secret):
        abort(401)

    event = json.loads(request.data)

    # Responder 200 imediatamente
    # Processar de forma assíncrona (Celery, RQ, etc.)
    if event.get('event') == 'run.completed':
        data = event['data']
        print(f"Run {data['external_id']}: {data['decision']} ({data['risk_band']})")

    return '', 200