Webhooks

curl -X POST https://gds.fretatech.com.br/api/partner/v1/webhooks \
  -H "Authorization: Bearer SEU_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://seu-sistema.com.br/webhooks/gds",
    "events": [
      "order.status_changed",
      "order_item.driver_assigned",
      "order_item.vehicle_assigned",
      "order_item.status_changed"
    ],
    "secret": "seu_segredo_hmac_aleatorio"
  }'

{
  "data": {
    "id": "wh_01jk2m3n4p5q6r7s",
    "url": "https://seu-sistema.com.br/webhooks/gds",
    "events": ["order.status_changed", "order_item.driver_assigned"],
    "active": true,
    "created_at": "2026-03-06T14:00:00.000000Z"
  }
}

{
  "event": "order_item.driver_assigned",
  "timestamp": "2026-04-14T18:30:00.000000Z",
  "data": {
    "order_id": "ord_01jk2m3n4p5q6r7s",
    "order_item_id": "item_01jk2m3n4p5q6r7s",
    "driver": {
      "name": "Carlos Eduardo Santos",
      "phone": "11988887777",
      "document": "12345678901"
    }
  }
}

assinatura = HMAC-SHA256(payload_raw_bytes, seu_secret)

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload, 'utf8')
    .digest('hex');

  // Comparacao segura contra timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(expectedSignature, 'hex'),
    Buffer.from(signature, 'hex')
  );
}

// Exemplo de uso em Express.js
app.post('/webhooks/gds', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-signature'];
  const secret = process.env.CGD_WEBHOOK_SECRET;

  if (!verifyWebhookSignature(req.body, signature, secret)) {
    return res.status(401).json({ error: 'Assinatura invalida' });
  }

  const event = JSON.parse(req.body);
  console.log('Evento recebido:', event.event);

  // Processe o evento aqui
  res.json({ received: true });
});

<?php

function verifyWebhookSignature(string $payload, string $signature, string $secret): bool
{
    $expectedSignature = hash_hmac('sha256', $payload, $secret);
    return hash_equals($expectedSignature, $signature);
}

// Exemplo de uso em Laravel
Route::post('/webhooks/gds', function (Request $request) {
    $payload = $request->getContent();
    $signature = $request->header('X-Signature');
    $secret = config('services.gds.webhook_secret');

    if (!verifyWebhookSignature($payload, $signature, $secret)) {
        return response()->json(['error' => 'Assinatura invalida'], 401);
    }

    $event = json_decode($payload, true);
    Log::info('CGD webhook recebido', ['event' => $event['event']]);

    // Processe o evento aqui

    return response()->json(['received' => true]);
});

curl -X GET https://gds.fretatech.com.br/api/partner/v1/webhooks \
  -H "Authorization: Bearer SEU_TOKEN"

curl -X PUT https://gds.fretatech.com.br/api/partner/v1/webhooks/wh_01jk2m3n4p5q6r7s \
  -H "Authorization: Bearer SEU_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://novo-url.com.br/webhooks/gds",
    "events": ["order.status_changed"],
    "active": false
  }'

curl -X DELETE https://gds.fretatech.com.br/api/partner/v1/webhooks/wh_01jk2m3n4p5q6r7s \
  -H "Authorization: Bearer SEU_TOKEN"