Webhooks

{
  "version": 1,
  "eventId": "pix_cashin:E12345678202609031200abcdef123456",
  "type": "pix.cashin.received",
  "seq": 42,
  "time": "2026-09-03T12:00:00.000Z",
  "accountId": "4b7c2a11-1f56-4e63-a8c1-81d2cb1b31c8",
  "data": {
    "amountCents": 5000,
    "endToEndId": "E12345678202609031200abcdef123456"
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

const TOLERANCIA_SEGUNDOS = 300;

function verificar(rawBody, header, whsec) {
  const [, t] = header.match(/t=(\d+)/) ?? [];
  const [, v1] = header.match(/v1=([0-9a-f]+)/) ?? [];
  if (!t || !v1) return false;

  // Recusa um corpo capturado e reenviado depois: cada tentativa traz um t= novo.
  if (Math.abs(Date.now() / 1000 - Number(t)) > TOLERANCIA_SEGUNDOS) return false;

  const esperado = createHmac("sha256", whsec).update(`${t}.${rawBody}`).digest();
  const recebido = Buffer.from(v1, "hex");

  // timingSafeEqual lança quando os tamanhos diferem: compare antes.
  return recebido.length === esperado.length && timingSafeEqual(recebido, esperado);
}

GET /v1/webhooks/deliveries
Escopo: webhooks:read

curl "https://api.prismapay.com.br/v1/webhooks/deliveries?limit=50&status=dead" \
  -H "X-Api-Key: pk_live_seu_key_id" \
  -H "X-Timestamp: 1767000000" \
  -H "X-Signature: assinatura_hex"

{
  "data": [
    {
      "id": "a3f1c9d2-77b4-4c1e-9c6e-2f0f9b7d1a44",
      "seq": 1042,
      "eventId": "pix_cashin:E12345678202609031200abcdef123456",
      "eventType": "pix.cashin.received",
      "accountId": "4b7c2a11-1f56-4e63-a8c1-81d2cb1b31c8",
      "status": "dead",
      "payload": {
        "amountCents": 5000,
        "endToEndId": "E12345678202609031200abcdef123456"
      },
      "attempts": 20,
      "lastStatusCode": 502,
      "failureReason": "http_error",
      "lastAttemptAt": "2026-09-02T12:00:00.000Z",
      "deliveredAt": null,
      "nextRetryAt": null,
      "createdAt": "2026-09-01T12:00:00.000Z"
    }
  ],
  "pagination": { "limit": 50, "nextCursor": 1042 }
}