Documentation de l’API

curl https://enotif.sahelab.com/v1/requests \
  -H "Authorization: Bearer sk_test_…" \
  -H "Content-Type: application/json" \
  -d '{ "phone": "+22370000001", "action": "login", "title": "Connexion à Sahelab" }'

curl https://enotif.sahelab.com/v1/ping -H "Authorization: Bearer sk_test_…"

# { "application": { "id": "app_…", "name": "Sahelab" }, "livemode": false }

curl https://enotif.sahelab.com/v1/requests \
  -H "Authorization: Bearer sk_test_…" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 8f14e45f-ceea-467f-a8f6-0a3b1d2c9e71" \
  -d '{
    "phone": "+22370000001",
    "action": "login",
    "title": "Connexion à Sahelab",
    "message": "Une connexion est demandée.",
    "context": [
      { "label": "Navigateur", "value": "Firefox" },
      { "label": "Appareil", "value": "Linux" }
    ],
    "number_matching": true,
    "metadata": { "session": "abc" }
  }'

curl https://enotif.sahelab.com/v1/requests/req_7Hq2kLmN3pQrS8tUvWx1Yz/verify \
  -H "Authorization: Bearer sk_test_…" \
  -H "Content-Type: application/json" \
  -d '{ "code": "482913" }'

"number_matching": { "number": 47 }

{
  "id": "req_7Hq2kLmN3pQrS8tUvWx1Yz",
  "object": "request",
  "livemode": false,
  "user": "usr_Q4mZ9xK2pL7nR1sT",
  "phone": "+22370000001",
  "action": "login",
  "mode": "approval",
  "title": "Connexion à Sahelab",
  "message": "Une connexion est demandée.",
  "context": [
    { "label": "Navigateur", "value": "Firefox" },
    { "label": "Appareil", "value": "Linux" }
  ],
  "number_matching": { "number": 47 },
  "metadata": { "session": "abc" },
  "status": "pending",
  "failure_reason": null,
  "delivered_at": null,
  "decided_at": null,
  "expires_at": 1791371100,
  "created_at": 1791370800
}

curl https://enotif.sahelab.com/v1/messages \
  -H "Authorization: Bearer sk_test_…" \
  -H "Content-Type: application/json" \
  -d '{
    "user": "usr_Q4mZ9xK2pL7nR1sT",
    "title": "Votre commande est prête",
    "body": "Retrait au comptoir dès 14 h."
  }'

# { "id": "msg_…", "object": "message", "user": "usr_…",
#   "status": "sent", "failure_reason": null, "created_at": 1791370900 }

POST /enotif/webhook HTTP/1.1
Content-Type: application/json
User-Agent: eNotif-Webhooks/1.0
X-ENotif-Event: request.approved
X-ENotif-Event-Id: evt_3NfQ8rT2LmZx9KpW
X-ENotif-Timestamp: 1791370812
X-ENotif-Signature: t=1791370812,v1=5f2b…c9

{
  "id": "evt_3NfQ8rT2LmZx9KpW",
  "object": "event",
  "type": "request.approved",
  "livemode": false,
  "created": 1791370812,
  "data": { "object": { "id": "req_7Hq2kLmN3pQrS8tUvWx1Yz", "object": "request", "status": "approved", … } }
}

v1 = hex(HMAC_SHA256(secret, t + "." + corps_brut))

<?php
// The raw body, exactly as received — never json_encode(json_decode(...)).
$payload = file_get_contents('php://input');
$header  = $_SERVER['HTTP_X_ENOTIF_SIGNATURE'] ?? '';
$secret  = getenv('ENOTIF_WEBHOOK_SECRET'); // whsec_…

function enotif_verify(
    string $payload, string $header, string $secret, int $tolerance = 300
): bool {
    $t = null;
    $signatures = [];
    foreach (explode(',', $header) as $part) {
        [$key, $value] = array_pad(explode('=', trim($part), 2), 2, '');
        if ($key === 't') $t = $value;
        if ($key === 'v1' && $value !== '') $signatures[] = $value;
    }
    if ($t === null || !ctype_digit($t) || $signatures === []) return false;
    if (abs(time() - (int) $t) > $tolerance) return false;

    $expected = hash_hmac('sha256', $t . '.' . $payload, $secret);
    foreach ($signatures as $signature) {
        if (hash_equals($expected, $signature)) return true; // constant time
    }
    return false;
}

if (!enotif_verify($payload, $header, $secret)) {
    http_response_code(400);
    exit;
}

$event = json_decode($payload, true);

// Deduplicate: a retry carries the same id. A UNIQUE column makes it safe.
if (already_processed($event['id'])) {
    http_response_code(200);
    exit;
}
mark_processed($event['id']);

if ($event['type'] === 'request.approved') {
    $request = $event['data']['object']; // $request['id'], $request['user'], $request['metadata']
    // … sign the session in
}
http_response_code(200);

import crypto from 'node:crypto';
import express from 'express';

const secret = process.env.ENOTIF_WEBHOOK_SECRET; // whsec_…
const app = express();

function verify(rawBody, header, tolerance = 300) {
  let t = null;
  const signatures = [];
  for (const part of (header || '').split(',')) {
    const [key, value = ''] = part.trim().split('=', 2);
    if (key === 't') t = value;
    if (key === 'v1' && value) signatures.push(value);
  }
  if (!t || !/^\d+$/.test(t) || signatures.length === 0) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - Number(t)) > tolerance) return false;

  const expected = Buffer.from(
    crypto.createHmac('sha256', secret).update(t + '.').update(rawBody).digest('hex'),
  );
  return signatures.some((s) => {
    const given = Buffer.from(s);
    return given.length === expected.length && crypto.timingSafeEqual(given, expected);
  });
}

// express.raw: the body stays a Buffer, byte for byte.
app.post('/enotif/webhook', express.raw({ type: 'application/json' }), async (req, res) => {
  if (!verify(req.body, req.get('X-ENotif-Signature'))) return res.sendStatus(400);

  const event = JSON.parse(req.body.toString('utf8'));

  // Deduplicate: a retry carries the same id.
  if (await alreadyProcessed(event.id)) return res.sendStatus(200);
  await markProcessed(event.id);

  if (event.type === 'request.approved') {
    const request = event.data.object; // request.id, request.user, request.metadata
    // … sign the session in
  }
  res.sendStatus(200);
});

import hashlib
import hmac
import json
import os
import time

from flask import Flask, abort, request

SECRET = os.environ["ENOTIF_WEBHOOK_SECRET"].encode()  # whsec_…
app = Flask(__name__)


def verify(raw: bytes, header: str, tolerance: int = 300) -> bool:
    t, signatures = None, []
    for part in (header or "").split(","):
        key, _, value = part.strip().partition("=")
        if key == "t":
            t = value
        elif key == "v1" and value:
            signatures.append(value)
    if not t or not t.isdigit() or not signatures:
        return False
    if abs(time.time() - int(t)) > tolerance:
        return False

    expected = hmac.new(SECRET, t.encode() + b"." + raw, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(expected, s) for s in signatures)  # constant time


@app.post("/enotif/webhook")
def enotif_webhook():
    raw = request.get_data()  # the raw bytes
    if not verify(raw, request.headers.get("X-ENotif-Signature", "")):
        abort(400)

    event = json.loads(raw)

    # Deduplicate: a retry carries the same id.
    if already_processed(event["id"]):
        return "", 200
    mark_processed(event["id"])

    if event["type"] == "request.approved":
        req = event["data"]["object"]  # req["id"], req["user"], req["metadata"]
        # … sign the session in
    return "", 200

curl -X POST https://enotif.sahelab.com/v1/sandbox/requests/req_7Hq2kLmN3pQrS8tUvWx1Yz/approve \
  -H "Authorization: Bearer sk_test_…"

# ou …/deny pour simuler un refus

{
  "error": {
    "type": "invalid_request_error",
    "code": "phone_invalid",
    "message": "Le numéro doit être au format E.164 (+22370000001).",
    "param": "phone",
    "doc_url": "https://enotif.sahelab.com/docs#errors"
  }
}