Webhooks

curl -X POST "https://connect.withvayu.com/webhook" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "x-api-key: $VAYU_CLIENT_ID" \
  -d '{
    "callbackUrl": "https://your-server.com/webhooks/vayu",
    "eventType": "Overage"
  }'

import { Vayu } from 'vayu-ts';

const vayu = new Vayu(process.env.VAYU_API_KEY);

await vayu.webhooks.subscribe({
  callbackUrl: 'https://your-server.com/webhooks/vayu',
  eventType: 'Overage',
});

from vayu_sdk import Vayu
import os

vayu = Vayu(api_key=os.environ["VAYU_API_KEY"])

vayu.webhooks.subscribe(
    callback_url="https://your-server.com/webhooks/vayu",
    event_type="Overage",
)

import vayu "github.com/vayucode/vayu-sdks/go"

v := vayu.NewVayu(os.Getenv("VAYU_API_KEY"))

err := v.Webhooks.Subscribe(vayu.WebhookSubscribeRequest{
    CallbackUrl: "https://your-server.com/webhooks/vayu",
    EventType:   "Overage",
})

import express from 'express';
import { Vayu } from 'vayu-ts';

const vayu = new Vayu(process.env.VAYU_API_KEY);
const app = express();
app.use(express.json());

// Register the webhook (run once)
// await vayu.webhooks.subscribe({
//   callbackUrl: 'https://your-server.com/webhooks/vayu',
//   eventType: 'Overage',
// });

app.post('/webhooks/vayu', (req, res) => {
  const eventType = req.headers['x-webhook-type'];
  const payload = req.body;

  switch (eventType) {
    case 'Overage':
      console.log(`Overage of ${payload.overageAmount} ${payload.currency} for ${payload.customerName}`);
      break;

    case 'InvoiceApproved':
      console.log(`Invoice ${payload.invoiceId} approved`);
      break;

    case 'TierCrossed':
      console.log(`${payload.customerName} crossed a tier on ${payload.contractName}`);
      break;

    case 'AnonymousCustomer':
      console.log(`New anonymous customer created: ${payload.externalId}`);
      break;

    default:
      console.log(`Unhandled event: ${eventType}`);
  }

  res.sendStatus(200);
});

app.listen(3000, () => console.log('Listening on :3000'));

from flask import Flask, request
from vayu_sdk import Vayu
import os

vayu = Vayu(api_key=os.environ["VAYU_API_KEY"])
app = Flask(__name__)

# Register the webhook (run once)
# vayu.webhooks.subscribe(
#     callback_url="https://your-server.com/webhooks/vayu",
#     event_type="Overage",
# )

@app.route('/webhooks/vayu', methods=['POST'])
def handle_webhook():
    event_type = request.headers.get('X-Webhook-Type')
    payload = request.get_json()

    if event_type == 'Overage':
        print(f"Overage of {payload['overageAmount']} {payload['currency']} for {payload['customerName']}")

    elif event_type == 'InvoiceApproved':
        print(f"Invoice {payload['invoiceId']} approved")

    elif event_type == 'TierCrossed':
        print(f"{payload['customerName']} crossed a tier on {payload['contractName']}")

    elif event_type == 'AnonymousCustomer':
        print(f"New anonymous customer created: {payload['externalId']}")

    else:
        print(f"Unhandled event: {event_type}")

    return '', 200

if __name__ == '__main__':
    app.run(port=3000)

package main

import (
    "encoding/json"
    "fmt"
    "io"
    "net/http"

    vayu "github.com/vayucode/vayu-sdks/go"
)

// Register the webhook (run once)
// v := vayu.NewVayu(os.Getenv("VAYU_API_KEY"))
// v.Webhooks.Subscribe(vayu.WebhookSubscribeRequest{
//     CallbackUrl: "https://your-server.com/webhooks/vayu",
//     EventType:   "Overage",
// })

func main() {
    http.HandleFunc("/webhooks/vayu", func(w http.ResponseWriter, r *http.Request) {
        body, _ := io.ReadAll(r.Body)
        eventType := r.Header.Get("X-Webhook-Type")

        var payload map[string]interface{}
        json.Unmarshal(body, &payload)

        switch eventType {
        case "Overage":
            fmt.Printf("Overage of %v %v for %v\n",
                payload["overageAmount"], payload["currency"], payload["customerName"])

        case "InvoiceApproved":
            fmt.Printf("Invoice %v approved\n", payload["invoiceId"])

        case "TierCrossed":
            fmt.Printf("%v crossed a tier on %v\n",
                payload["customerName"], payload["contractName"])

        case "AnonymousCustomer":
            fmt.Printf("New anonymous customer created: %v\n", payload["externalId"])

        default:
            fmt.Printf("Unhandled event: %s\n", eventType)
        }

        w.WriteHeader(http.StatusOK)
    })

    fmt.Println("Listening on :3000")
    http.ListenAndServe(":3000", nil)
}

import { Vayu } from 'vayu-ts';

const vayu = new Vayu(process.env.VAYU_API_KEY);

app.post('/webhooks', async (req, res) => {
  const payload = JSON.stringify(req.body);
  const timestamp = Number(req.headers['x-timestamp']);
  const signature = String(req.headers['x-signature']);

  const isValid = vayu.webhooks.verifyWebhookSignature({
    payload,
    timestamp,
    signature,
    tolerance: 300, // optional — reject if older than 5 minutes (default)
  });

  if (!isValid) {
    return res.sendStatus(401);
  }

  console.log('Received webhook:', req.headers['x-webhook-type']);
  res.sendStatus(200);
});

import json, time, base64, math
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding
from flask import Flask, request

# Load Vayu's public key (provided during onboarding)
with open("vayu-public.pem", "rb") as f:
    public_key = serialization.load_pem_public_key(f.read())

TOLERANCE = 300  # 5 minutes

app = Flask(__name__)

@app.route('/webhooks', methods=['POST'])
def webhooks():
    payload = request.get_data(as_text=True)
    timestamp = int(request.headers.get('X-Timestamp', '0'))
    signature = request.headers.get('X-Signature', '')

    # Reject stale webhooks
    if abs(time.time() - timestamp) > TOLERANCE:
        return '', 401

    # Reconstruct the signed message
    message = f"{timestamp}.{json.dumps(json.loads(payload))}"

    try:
        public_key.verify(
            base64.b64decode(signature),
            message.encode(),
            padding.PKCS1v15(),
            hashes.SHA256(),
        )
    except Exception:
        return '', 401

    print('Received webhook:', request.headers.get('X-Webhook-Type'))
    return '', 200

import (
    "crypto"
    "crypto/rsa"
    "crypto/sha256"
    "crypto/x509"
    "encoding/base64"
    "encoding/pem"
    "fmt"
    "io"
    "math"
    "net/http"
    "os"
    "strconv"
    "time"
)

// Load Vayu's public key (provided during onboarding)
var publicKey *rsa.PublicKey

func init() {
    keyData, _ := os.ReadFile("vayu-public.pem")
    block, _ := pem.Decode(keyData)
    pub, _ := x509.ParsePKIXPublicKey(block.Bytes)
    publicKey = pub.(*rsa.PublicKey)
}

const tolerance = 300 // 5 minutes

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)
    timestamp, _ := strconv.ParseInt(r.Header.Get("X-Timestamp"), 10, 64)
    signature := r.Header.Get("X-Signature")

    // Reject stale webhooks
    if math.Abs(float64(time.Now().Unix()-timestamp)) > tolerance {
        http.Error(w, "stale webhook", http.StatusUnauthorized)
        return
    }

    // Reconstruct the signed message
    message := fmt.Sprintf("%d.%s", timestamp, string(body))
    hash := sha256.Sum256([]byte(message))

    sigBytes, _ := base64.StdEncoding.DecodeString(signature)
    err := rsa.VerifyPKCS1v15(publicKey, crypto.SHA256, hash[:], sigBytes)
    if err != nil {
        http.Error(w, "invalid signature", http.StatusUnauthorized)
        return
    }

    fmt.Println("Received webhook:", r.Header.Get("X-Webhook-Type"))

    w.WriteHeader(http.StatusOK)
}