Webhooks

curl -X POST https://your-domain.com/api/v1/chatbots/your-chatbot-id/webhooks \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer your-session-token" \
  -d '{
    "name": "Lead Notifications",
    "url": "https://yourapp.com/webhooks/leads",
    "eventTypes": ["LEAD_CREATED"],
    "maxRetries": 3,
    "retryDelay": 1000
  }'

const express = require('express');
const crypto = require('crypto');

const app = express();

// Use raw body parser for webhook signature verification
app.use('/webhooks', express.raw({type: 'application/json'}));

function verifyWebhookSignature(body, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex');
  
  const receivedSignature = signature.replace('sha256=', '');
  
  return crypto.timingSafeEqual(
    Buffer.from(expectedSignature, 'hex'),
    Buffer.from(receivedSignature, 'hex')
  );
}

app.post('/webhooks/pollybot', (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const webhookSecret = process.env.POLLYBOT_WEBHOOK_SECRET;
  
  // Verify the signature
  if (!verifyWebhookSignature(req.body, signature, webhookSecret)) {
    console.error('Invalid webhook signature');
    return res.status(401).send('Invalid signature');
  }
  
  // Parse the payload
  const payload = JSON.parse(req.body);
  // Handle different event types
  switch (payload.event) {
    case 'LEAD_CREATED':
      handleLeadCreated(payload.data);
      break;
    default:
  }
  
  // Always respond with 200 to acknowledge receipt
  res.status(200).send('OK');
});

function handleLeadCreated(lead) {
  // Add your business logic here:
  // - Send notification email
  // - Create record in CRM
  // - Trigger follow-up workflow
  // - etc.
}

app.listen(3000, () => {
});