docsWebhooks.title

POST /api/v1/webhooks/configure

{
  "url": "https://tu-servidor.com/webhooks/kustodia",
  "events": ["payment.deposited", "payment.released"]
}

// Respuesta:
{
  "success": true,
  "webhook": {
    "id": "...",
    "url": "https://tu-servidor.com/webhooks/kustodia",
    "secret": "abc123...",  ← Guarda este secreto
    "events": ["payment.deposited", "payment.released"],
    "active": true
  }
}

{
  "event": "payment.deposited",
  "payment_id": "a1b2c3d4-...",
  "timestamp": "2026-02-07T18:00:00Z",
  "data": {
    "id": "a1b2c3d4-...",
    "amount": 15000.00,
    "currency": "MXN",
    "status": "in_custody",
    "payer_email": "buyer@example.com",
    "recipient_email": "seller@example.com"
  }
}

// Node.js — Verificar firma
const crypto = require('crypto');

function verify(body, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(body))
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

app.post('/webhooks/kustodia', (req, res) => {
  const sig = req.headers['x-kustodia-signature'];
  if (!verify(req.body, sig, 'tu_webhook_secret')) {
    return res.status(401).send('Invalid');
  }

  // Procesar evento...
  res.status(200).json({ received: true });
});