Integração de cobrança via webhook

POST https://api.itstime.pro/api/integrations/collections/v1/sources/{PUBLIC_SOURCE_ID}/events

assinatura = HMAC-SHA256(SEU_SEGREDO, timestamp + "." + corpo_json_bruto)

X-Collection-Signature: sha256=HASH_HEXADECIMAL

{
  "schemaVersion": "1.0",
  "ingestionId": "cobranca-20260910-0001",
  "mode": "incremental",
  "occurredAt": "2026-09-10T14:30:00-03:00",
  "records": [
    {
      "schemaVersion": "1.0",
      "source": {
        "externalEventId": "evento-98765",
        "sourceUpdatedAt": "2026-09-10T14:30:00-03:00"
      },
      "customer": {
        "externalId": "cliente-123",
        "name": "Maria da Silva",
        "phone": "5511999999999",
        "document": "12345678900",
        "email": "maria@exemplo.com"
      },
      "creditor": {
        "externalId": "loja-01",
        "name": "Ótica Exemplo",
        "document": "12345678000190"
      },
      "receivable": {
        "externalId": "titulo-456",
        "description": "Parcela 2 de 3",
        "originalAmount": "250.00",
        "remainingAmount": "250.00",
        "currency": "BRL",
        "dueDate": "2026-09-05",
        "status": "open"
      },
      "payment": {
        "method": "pix",
        "pixKey": "financeiro@exemplo.com",
        "paymentUrl": "https://pagamentos.exemplo.com/titulo-456",
        "expiresAt": "2026-09-15T23:59:59-03:00"
      },
      "metadata": {
        "numeroParcela": 2,
        "filial": "São Paulo"
      }
    }
  ]
}

WEBHOOK_URL="https://api.itstime.pro/api/integrations/collections/v1/sources/{PUBLIC_SOURCE_ID}/events"
WEBHOOK_SECRET="SEU_SEGREDO"
TIMESTAMP=$(date +%s)
IDEMPOTENCY_KEY="cobranca-$(date +%s)"

BODY='{"schemaVersion":"1.0","ingestionId":"cobranca-20260910-0001","mode":"incremental","occurredAt":"2026-09-10T14:30:00-03:00","records":[{"schemaVersion":"1.0","source":{"externalEventId":"evento-98765","sourceUpdatedAt":"2026-09-10T14:30:00-03:00"},"customer":{"externalId":"cliente-123","name":"Maria da Silva","phone":"5511999999999"},"creditor":{"externalId":"loja-01","name":"Ótica Exemplo"},"receivable":{"externalId":"titulo-456","remainingAmount":"250.00","currency":"BRL","dueDate":"2026-09-05","status":"open"}}]}'

SIGNATURE=$(printf '%s.%s' "$TIMESTAMP" "$BODY"   | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET" -hex   | sed 's/^.* //')

curl --request POST "$WEBHOOK_URL"   --header "Content-Type: application/json"   --header "Idempotency-Key: $IDEMPOTENCY_KEY"   --header "X-Collection-Timestamp: $TIMESTAMP"   --header "X-Collection-Signature: sha256=$SIGNATURE"   --data-raw "$BODY"

import hashlib
import hmac
import json
import time
import uuid

import requests

WEBHOOK_URL = "https://api.itstime.pro/api/integrations/collections/v1/sources/{PUBLIC_SOURCE_ID}/events"
WEBHOOK_SECRET = "SEU_SEGREDO"

payload = {
    "schemaVersion": "1.0",
    "ingestionId": f"cobranca-{uuid.uuid4()}",
    "mode": "incremental",
    "occurredAt": "2026-09-10T14:30:00-03:00",
    "records": [{
        "schemaVersion": "1.0",
        "source": {
            "externalEventId": "evento-98765",
            "sourceUpdatedAt": "2026-09-10T14:30:00-03:00"
        },
        "customer": {
            "externalId": "cliente-123",
            "name": "Maria da Silva",
            "phone": "5511999999999"
        },
        "creditor": {"externalId": "loja-01", "name": "Ótica Exemplo"},
        "receivable": {
            "externalId": "titulo-456",
            "remainingAmount": "250.00",
            "currency": "BRL",
            "dueDate": "2026-09-05",
            "status": "open"
        }
    }]
}

body = json.dumps(payload, ensure_ascii=False, separators=(",", ":")).encode("utf-8")
timestamp = str(int(time.time()))
signature = hmac.new(
    WEBHOOK_SECRET.encode("utf-8"),
    timestamp.encode("utf-8") + b"." + body,
    hashlib.sha256
).hexdigest()

response = requests.post(
    WEBHOOK_URL,
    data=body,
    headers={
        "Content-Type": "application/json",
        "Idempotency-Key": payload["ingestionId"],
        "X-Collection-Timestamp": timestamp,
        "X-Collection-Signature": f"sha256={signature}"
    },
    timeout=30
)

print(response.status_code)
print(response.json())
response.raise_for_status()

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.time.Instant;
import java.util.UUID;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class ItsTimeWebhook {
  private static final String URL = "https://api.itstime.pro/api/integrations/collections/v1/sources/{PUBLIC_SOURCE_ID}/events";
  private static final String SECRET = "SEU_SEGREDO";

  public static void main(String[] args) throws Exception {
    String id = "cobranca-" + UUID.randomUUID();
    String body = "{"schemaVersion":"1.0","ingestionId":"" + id
      + "","mode":"incremental","occurredAt":"2026-09-10T14:30:00-03:00","
      + ""records":[{"schemaVersion":"1.0","source":{"
      + ""sourceUpdatedAt":"2026-09-10T14:30:00-03:00"},"customer":{"
      + ""externalId":"cliente-123","name":"Maria da Silva","
      + ""phone":"5511999999999"},"creditor":{"externalId":"loja-01"},"
      + ""receivable":{"externalId":"titulo-456","remainingAmount":"250.00","
      + ""currency":"BRL","dueDate":"2026-09-05","status":"open"}}]}";

    String timestamp = Long.toString(Instant.now().getEpochSecond());
    String signature = hmacSha256(timestamp + "." + body, SECRET);

    HttpRequest request = HttpRequest.newBuilder(URI.create(URL))
      .header("Content-Type", "application/json")
      .header("Idempotency-Key", id)
      .header("X-Collection-Timestamp", timestamp)
      .header("X-Collection-Signature", "sha256=" + signature)
      .POST(HttpRequest.BodyPublishers.ofString(body, StandardCharsets.UTF_8))
      .build();

    HttpResponse<String> response = HttpClient.newHttpClient()
      .send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.statusCode());
    System.out.println(response.body());
  }

  private static String hmacSha256(String content, String secret) throws Exception {
    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
    byte[] digest = mac.doFinal(content.getBytes(StandardCharsets.UTF_8));
    StringBuilder hex = new StringBuilder(digest.length * 2);
    for (byte value : digest) hex.append(String.format("%02x", value & 0xff));
    return hex.toString();
  }
}

const CryptoJS = pm.require("npm:crypto-js@4.2.0");
const timestamp = Math.floor(Date.now() / 1000).toString();
const body = pm.request.body.raw;
const secret = pm.environment.get("webhook_secret");

if (!secret) throw new Error("Configure a variável webhook_secret.");

const hash = CryptoJS.HmacSHA256(timestamp + "." + body, secret)
  .toString(CryptoJS.enc.Hex);

pm.variables.set("collection_timestamp", timestamp);
pm.variables.set("collection_signature", "sha256=" + hash);
pm.variables.set("idempotency_key", "postman-" + Date.now());

{
  "accepted": true,
  "duplicate": false,
  "ingestionId": "8d7c1398-ec65-4b3c-8827-b17c66371a3e",
  "status": "succeeded",
  "receivedCount": 1,
  "createdCount": 1,
  "updatedCount": 0,
  "unchangedCount": 0,
  "notPresentCount": 0,
  "affectedCasesCount": 1
}