Partner Onboarding Guide

import requests

BASE_URL = "https://departcart.com"

def get_bearer_token(api_key, api_secret, duration_hours=24):
    """Exchange API credentials for a short-lived bearer token."""
    response = requests.post(
        f"{BASE_URL}/generate-bearer-token",
        json={
            "api_key": api_key,
            "api_secret": api_secret,
            "duration_hours": duration_hours,
        },
    )
    response.raise_for_status()
    return response.json()["bearer_token"]

def generate_seatmap_deeplink(bearer_token, pnr, last_name, source="api"):
    """Generate a customer-facing seatmap deeplink."""
    response = requests.post(
        f"{BASE_URL}/api/generate-encrypted-seatmap-url",
        headers={
            "Authorization": f"Bearer {bearer_token}",
            "Content-Type": "application/json",
        },
        json={
            "pnr": pnr,
            "last_name": last_name,
            "source": source,
        },
    )
    response.raise_for_status()
    seatmap_url = response.json()["seatmap_url"]
    return f"{BASE_URL}{seatmap_url}"

# Example usage (run this from your backend)
token = get_bearer_token("YOUR_API_KEY", "YOUR_API_SECRET")
deeplink = generate_seatmap_deeplink(token, pnr="ABC123", last_name="SMITH")
print(deeplink)  # https://departcart.com/seatmap?id=...&source=api

const BASE_URL = 'https://departcart.com';

async function getBearerToken(apiKey, apiSecret, durationHours = 24) {
    // Exchange API credentials for a short-lived bearer token.
    const response = await fetch(`${BASE_URL}/generate-bearer-token`, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({
            api_key: apiKey,
            api_secret: apiSecret,
            duration_hours: durationHours,
        }),
    });
    if (!response.ok) throw new Error(`Token request failed: ${response.status}`);
    const data = await response.json();
    return data.bearer_token;
}

async function generateSeatmapDeeplink(bearerToken, pnr, lastName, source = 'api') {
    // Generate a customer-facing seatmap deeplink.
    const response = await fetch(`${BASE_URL}/api/generate-encrypted-seatmap-url`, {
        method: 'POST',
        headers: {
            Authorization: `Bearer ${bearerToken}`,
            'Content-Type': 'application/json',
        },
        body: JSON.stringify({ pnr, last_name: lastName, source }),
    });
    if (!response.ok) throw new Error(`Deeplink request failed: ${response.status}`);
    const data = await response.json();
    return `${BASE_URL}${data.seatmap_url}`;
}

// Example usage (run this from your backend so the API secret stays server-side)
const token = await getBearerToken('YOUR_API_KEY', 'YOUR_API_SECRET');
const deeplink = await generateSeatmapDeeplink(token, 'ABC123', 'SMITH');
console.log(deeplink); // https://departcart.com/seatmap?id=...&source=api

import hmac
import hashlib
from flask import Flask, request

app = Flask(__name__)

@app.route('/webhooks/departcart', methods=['POST'])
def handle_departcart_webhook():
    # Verify signature
    payload = request.get_data(as_text=True)
    signature = request.headers.get('X-DepartCart-Signature')

    if not verify_signature(payload, signature):
        return 'Unauthorized', 401

    # Process event
    event = request.get_json()
    process_webhook_event(event)

    return 'OK', 200

def verify_signature(payload, signature):
    expected = hmac.new(
        WEBHOOK_SECRET.encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(f"sha256={expected}", signature)

def process_webhook_event(event):
    event_type = event.get('type')

    if event_type == 'transaction.completed':
        handle_transaction_completed(event['data'])
    elif event_type == 'payment.processed':
        handle_payment_processed(event['data'])
    elif event_type == 'fulfillment.updated':
        handle_fulfillment_updated(event['data'])
    else:
        print(f"Unknown event type: {event_type}")

def handle_transaction_completed(data):
    transaction_id = data['transaction_id']
    amount = data['amount']
    print(f"Transaction {transaction_id} completed for ${amount}")

using System;
using System.IO;
using System.Security.Cryptography;
using System.Text;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Http;
using Newtonsoft.Json;

[ApiController]
[Route("webhooks")]
public class WebhookController : ControllerBase
{
    private readonly string _webhookSecret;

    public WebhookController(IConfiguration configuration)
    {
        _webhookSecret = configuration["DepartCart:WebhookSecret"];
    }

    [HttpPost("departcart")]
    public async Task<IActionResult> HandleDepartCartWebhook()
    {
        // Read payload
        string payload;
        using (var reader = new StreamReader(Request.Body))
        {
            payload = await reader.ReadToEndAsync();
        }

        // Verify signature
        var signature = Request.Headers["X-DepartCart-Signature"].FirstOrDefault();
        if (!VerifySignature(payload, signature))
        {
            return Unauthorized("Invalid signature");
        }

        // Process event
        var webhookEvent = JsonConvert.DeserializeObject<WebhookEvent>(payload);
        ProcessWebhookEvent(webhookEvent);

        return Ok("Success");
    }

    private bool VerifySignature(string payload, string signature)
    {
        if (string.IsNullOrEmpty(signature) || !signature.StartsWith("sha256="))
        {
            return false;
        }

        var expectedSignature = signature.Substring(7); // Remove "sha256=" prefix

        using (var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(_webhookSecret)))
        {
            var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(payload));
            var computedSignature = Convert.ToHexString(hash).ToLower();

            return CryptographicOperations.FixedTimeEquals(
                Encoding.UTF8.GetBytes(expectedSignature),
                Encoding.UTF8.GetBytes(computedSignature)
            );
        }
    }

    private void ProcessWebhookEvent(WebhookEvent webhookEvent)
    {
        switch (webhookEvent.Type)
        {
            case "transaction.completed":
                HandleTransactionCompleted(webhookEvent.Data);
                break;
            case "payment.processed":
                HandlePaymentProcessed(webhookEvent.Data);
                break;
            case "fulfillment.updated":
                HandleFulfillmentUpdated(webhookEvent.Data);
                break;
            default:
                Console.WriteLine($"Unknown event type: {webhookEvent.Type}");
                break;
        }
    }

    private void HandleTransactionCompleted(dynamic data)
    {
        var transactionId = data.transaction_id;
        var amount = data.amount;
        Console.WriteLine($"Transaction {transactionId} completed for ${amount}");
    }

    private void HandlePaymentProcessed(dynamic data)
    {
        var paymentId = data.payment_id;
        Console.WriteLine($"Payment {paymentId} processed successfully");
    }

    private void HandleFulfillmentUpdated(dynamic data)
    {
        var status = data.status;
        Console.WriteLine($"Fulfillment status updated to: {status}");
    }
}

public class WebhookEvent
{
    public string Type { get; set; }
    public dynamic Data { get; set; }
}

const express = require('express');
const crypto = require('crypto');
const app = express();

// Middleware to capture raw body for signature verification
app.use('/webhooks/departcart', express.raw({ type: 'application/json' }));

app.post('/webhooks/departcart', (req, res) => {
    try {
        // Get payload and signature
        const payload = req.body.toString();
        const signature = req.headers['x-departcart-signature'];

        // Verify signature
        if (!verifySignature(payload, signature)) {
            return res.status(401).send('Unauthorized');
        }

        // Process event
        const event = JSON.parse(payload);
        processWebhookEvent(event);

        res.status(200).send('OK');
    } catch (error) {
        console.error('Webhook error:', error);
        res.status(500).send('Internal Server Error');
    }
});

function verifySignature(payload, signature) {
    if (!signature || !signature.startsWith('sha256=')) {
        return false;
    }

    const expectedSignature = signature.slice(7); // Remove 'sha256=' prefix
    const computedSignature = crypto
        .createHmac('sha256', process.env.WEBHOOK_SECRET)
        .update(payload, 'utf8')
        .digest('hex');

    return crypto.timingSafeEqual(
        Buffer.from(expectedSignature, 'hex'),
        Buffer.from(computedSignature, 'hex')
    );
}

function processWebhookEvent(event) {
    switch (event.type) {
        case 'transaction.completed':
            handleTransactionCompleted(event.data);
            break;
        case 'payment.processed':
            handlePaymentProcessed(event.data);
            break;
        case 'fulfillment.updated':
            handleFulfillmentUpdated(event.data);
            break;
        default:
            console.log(`Unknown event type: ${event.type}`);
    }
}

function handleTransactionCompleted(data) {
    const transactionId = data.transaction_id;
    const amount = data.amount;
    console.log(`Transaction ${transactionId} completed for $${amount}`);
}

function handlePaymentProcessed(data) {
    const paymentId = data.payment_id;
    console.log(`Payment ${paymentId} processed successfully`);
}

function handleFulfillmentUpdated(data) {
    const status = data.status;
    console.log(`Fulfillment status updated to: ${status}`);
}

app.listen(3000, () => {
    console.log('Webhook server listening on port 3000');
});

import org.springframework.web.bind.annotation.*;
import org.springframework.http.ResponseEntity;
import org.springframework.beans.factory.annotation.Value;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.JsonNode;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.Arrays;

@RestController
@RequestMapping("/webhooks")
public class WebhookController {

    @Value("${departcart.webhook.secret}")
    private String webhookSecret;

    private final ObjectMapper objectMapper = new ObjectMapper();

    @PostMapping("/departcart")
    public ResponseEntity<String> handleDepartCartWebhook(
            @RequestBody String payload,
            @RequestHeader("X-DepartCart-Signature") String signature) {

        try {
            // Verify signature
            if (!verifySignature(payload, signature)) {
                return ResponseEntity.status(401).body("Unauthorized");
            }

            // Process event
            JsonNode event = objectMapper.readTree(payload);
            processWebhookEvent(event);

            return ResponseEntity.ok("Success");
        } catch (Exception e) {
            System.err.println("Webhook processing error: " + e.getMessage());
            return ResponseEntity.status(500).body("Internal Server Error");
        }
    }

    private boolean verifySignature(String payload, String signature) {
        if (signature == null || !signature.startsWith("sha256=")) {
            return false;
        }

        try {
            String expectedSignature = signature.substring(7); // Remove "sha256=" prefix

            Mac mac = Mac.getInstance("HmacSHA256");
            SecretKeySpec secretKeySpec = new SecretKeySpec(
                webhookSecret.getBytes(), "HmacSHA256");
            mac.init(secretKeySpec);

            byte[] hash = mac.doFinal(payload.getBytes());
            String computedSignature = bytesToHex(hash);

            return MessageDigest.isEqual(
                expectedSignature.getBytes(),
                computedSignature.getBytes()
            );
        } catch (NoSuchAlgorithmException | InvalidKeyException e) {
            System.err.println("Signature verification error: " + e.getMessage());
            return false;
        }
    }

    private void processWebhookEvent(JsonNode event) {
        String eventType = event.get("type").asText();
        JsonNode data = event.get("data");

        switch (eventType) {
            case "transaction.completed":
                handleTransactionCompleted(data);
                break;
            case "payment.processed":
                handlePaymentProcessed(data);
                break;
            case "fulfillment.updated":
                handleFulfillmentUpdated(data);
                break;
            default:
                System.out.println("Unknown event type: " + eventType);
        }
    }

    private void handleTransactionCompleted(JsonNode data) {
        String transactionId = data.get("transaction_id").asText();
        double amount = data.get("amount").asDouble();
        System.out.println("Transaction " + transactionId + 
                          " completed for $" + amount);
    }

    private void handlePaymentProcessed(JsonNode data) {
        String paymentId = data.get("payment_id").asText();
        System.out.println("Payment " + paymentId + " processed successfully");
    }

    private void handleFulfillmentUpdated(JsonNode data) {
        String status = data.get("status").asText();
        System.out.println("Fulfillment status updated to: " + status);
    }

    private String bytesToHex(byte[] bytes) {
        StringBuilder result = new StringBuilder();
        for (byte b : bytes) {
            result.append(String.format("%02x", b));
        }
        return result.toString();
    }
}

require 'sinatra'
require 'json'
require 'openssl'

# Configure webhook secret
WEBHOOK_SECRET = ENV['WEBHOOK_SECRET']

post '/webhooks/departcart' do
  # Get payload and signature
  payload = request.body.read
  signature = request.env['HTTP_X_DEPARTCART_SIGNATURE']

  # Verify signature
  unless verify_signature(payload, signature)
    halt 401, 'Unauthorized'
  end

  # Process event
  begin
    event = JSON.parse(payload)
    process_webhook_event(event)
  rescue JSON::ParserError => e
    puts "JSON parsing error: #{e.message}"
    halt 400, 'Bad Request'
  rescue StandardError => e
    puts "Processing error: #{e.message}"
    halt 500, 'Internal Server Error'
  end

  status 200
  body 'OK'
end

def verify_signature(payload, signature)
  return false if signature.nil? || !signature.start_with?('sha256=')

  expected_signature = signature[7..-1] # Remove 'sha256=' prefix
  computed_signature = OpenSSL::HMAC.hexdigest(
    OpenSSL::Digest.new('sha256'),
    WEBHOOK_SECRET,
    payload
  )

  # Use secure comparison to prevent timing attacks
  Rack::Utils.secure_compare(expected_signature, computed_signature)
end

def process_webhook_event(event)
  event_type = event['type']
  data = event['data']

  case event_type
  when 'transaction.completed'
    handle_transaction_completed(data)
  when 'payment.processed'
    handle_payment_processed(data)
  when 'fulfillment.updated'
    handle_fulfillment_updated(data)
  else
    puts "Unknown event type: #{event_type}"
  end
end

def handle_transaction_completed(data)
  transaction_id = data['transaction_id']
  amount = data['amount']
  puts "Transaction #{transaction_id} completed for $#{amount}"
end

def handle_payment_processed(data)
  payment_id = data['payment_id']
  puts "Payment #{payment_id} processed successfully"
end

def handle_fulfillment_updated(data)
  status = data['status']
  puts "Fulfillment status updated to: #{status}"
end

# Start the server
if __FILE__ == $0
  set :port, 4567
  set :bind, '0.0.0.0'
  puts "Webhook server starting on port 4567"
end