Recebendo eventos

import crypto from 'node:crypto'
import express from 'express'

const app = express()

app.post('/webhooks/deliveryvip', express.raw({ type: 'application/json' }), (req, res) => {
  const secret = storeSecretFor(req.get('X-App-MerchantId')) // o ods_... da loja, do seu banco
  const expected = crypto.createHmac('sha256', secret).update(req.body).digest('hex')
  const received = req.get('X-App-Signature') ?? ''

  const valid =
    received.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received))
  if (!valid) return res.status(401).end()

  const event = JSON.parse(req.body) // parse só depois de validar
  enqueue(event) // processe de forma assíncrona
  res.status(200).end()
})

import hashlib
import hmac

from flask import Flask, abort, request

app = Flask(__name__)


@app.post("/webhooks/deliveryvip")
def webhook():
    secret = store_secret_for(request.headers.get("X-App-MerchantId"))  # o ods_... da loja
    raw = request.get_data()  # bytes exatamente como chegaram
    expected = hmac.new(secret.encode(), raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, request.headers.get("X-App-Signature", "")):
        abort(401)

    enqueue(request.get_json())  # processe de forma assíncrona
    return "", 200

secret = store_secret_for(request.headers["X-App-MerchantId"])
expected = OpenSSL::HMAC.hexdigest("SHA256", secret, request.raw_post)
valid = ActiveSupport::SecurityUtils.secure_compare(expected, request.headers["X-App-Signature"].to_s)

curl --request GET 'https://od.deliveryvip.com.br/v1/events:polling' \
  --header 'Authorization: Bearer {token}'

const response = await fetch('https://od.deliveryvip.com.br/v1/events:polling', {
  headers: { Authorization: `Bearer ${token}` },
})
const events = response.status === 204 ? [] : await response.json()

response = requests.get(
    "https://od.deliveryvip.com.br/v1/events:polling",
    headers={"Authorization": f"Bearer {token}"},
)
events = [] if response.status_code == 204 else response.json()

curl --request POST 'https://od.deliveryvip.com.br/v1/events/acknowledgment' \
  --header 'Authorization: Bearer {token}' \
  --header 'Content-Type: application/json' \
  --data '[{ "id": "9a24ea9e-5743-4957-9b83-7a4b4f2a4597" }]'

await fetch('https://od.deliveryvip.com.br/v1/events/acknowledgment', {
  method: 'POST',
  headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
  body: JSON.stringify(events.map(({ eventId }) => ({ id: eventId }))),
})

requests.post(
    "https://od.deliveryvip.com.br/v1/events/acknowledgment",
    headers={"Authorization": f"Bearer {token}"},
    json=[{"id": event["eventId"]} for event in events],
)