API, webhooks and Azure AD

{
  "id": "string",
  "type": "string",
  "timestamp": "string",
  "data": { }
}

using System.Security.Cryptography;
using System.Text;

public class WebhookValidator
{
    public static bool ValidateSignature(string payload, string secret, string receivedSignature)
    {
        var keyBytes = Encoding.UTF8.GetBytes(secret);
        var payloadBytes = Encoding.UTF8.GetBytes(payload);

        using var hmac = new HMACSHA256(keyBytes);
        var hashBytes = hmac.ComputeHash(payloadBytes);
        var computedSignature = Convert.ToHexString(hashBytes).ToLowerInvariant();

        return computedSignature == receivedSignature;
    }
}

// Usage in ASP.NET Core controller:
[HttpPost("webhook")]
public async Task<IActionResult> HandleWebhook()
{
    using var reader = new StreamReader(Request.Body);
    var payload = await reader.ReadToEndAsync();

    var signature = Request.Headers["X-Signature"].FirstOrDefault();
    var secret = "your-webhook-secret";

    if (!WebhookValidator.ValidateSignature(payload, secret, signature))
    {
        return Unauthorized("Invalid signature");
    }

    var webhookEvent = JsonSerializer.Deserialize<WebhookPayload>(payload);
    // Process the event...

    return Ok();
}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;

public class WebhookValidator {

    public static boolean validateSignature(String payload, String secret, String receivedSignature) {
        try {
            Mac hmac = Mac.getInstance("HmacSHA256");
            SecretKeySpec secretKey = new SecretKeySpec(
                secret.getBytes(StandardCharsets.UTF_8),
                "HmacSHA256"
            );
            hmac.init(secretKey);

            byte[] hashBytes = hmac.doFinal(payload.getBytes(StandardCharsets.UTF_8));
            String computedSignature = bytesToHex(hashBytes).toLowerCase();

            return computedSignature.equals(receivedSignature);
        } catch (Exception e) {
            return false;
        }
    }

    private static String bytesToHex(byte[] bytes) {
        StringBuilder sb = new StringBuilder();
        for (byte b : bytes) {
            sb.append(String.format("%02x", b));
        }
        return sb.toString();
    }
}

// Usage in Spring Boot controller:
@PostMapping("/webhook")
public ResponseEntity<String> handleWebhook(
        @RequestBody String payload,
        @RequestHeader("X-Signature") String signature) {

    String secret = "your-webhook-secret";

    if (!WebhookValidator.validateSignature(payload, secret, signature)) {
        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Invalid signature");
    }

    // Process the event...
    return ResponseEntity.ok("OK");
}

const crypto = require('crypto');

function validateSignature(payload, secret, receivedSignature) {
    const computedSignature = crypto
        .createHmac('sha256', secret)
        .update(payload, 'utf8')
        .digest('hex');

    return computedSignature === receivedSignature;
}

// Usage with Express:
const express = require('express');
const app = express();

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
    const payload = req.body.toString('utf8');
    const signature = req.headers['x-signature'];
    const secret = 'your-webhook-secret';

    if (!validateSignature(payload, secret, signature)) {
        return res.status(401).send('Invalid signature');
    }

    const event = JSON.parse(payload);
    // Process the event...

    res.status(200).send('OK');
});

import hmac
import hashlib

def validate_signature(payload: str, secret: str, received_signature: str) -> bool:
    computed_signature = hmac.new(
        secret.encode('utf-8'),
        payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(computed_signature, received_signature)

# Usage with Flask:
from flask import Flask, request, abort
import json

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def handle_webhook():
    payload = request.get_data(as_text=True)
    signature = request.headers.get('X-Signature')
    secret = 'your-webhook-secret'

    if not validate_signature(payload, secret, signature):
        abort(401, 'Invalid signature')

    event = json.loads(payload)
    # Process the event...

    return 'OK', 200

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "type": "ReservationCreated",
  "timestamp": "2024-01-15T09:30:00Z",
  "data": {
    "personAssetId": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    "personId": "550e8400-e29b-41d4-a716-446655440000",
    "assetId": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
    "assetName": "Desk A-101",
    "reservationStartTimeUtc": "2024-01-16T09:00:00Z",
    "reservationEndTimeUtc": "2024-01-16T17:00:00Z",
    "reservationStartTimeLocal": "2024-01-16T20:00:00",
    "reservationEndTimeLocal": "2024-01-17T04:00:00",
    "timezoneIana": "Australia/Sydney",
    "siteLocationId": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "siteLocationName": "Sydney HQ",
    "siteLevelId": "8f14e45f-ceea-467f-a0e8-14db0148c3a1",
    "siteLevelName": "Level 5",
    "city": "Sydney",
    "region": "NSW",
    "country": "Australia",
    "floorName": "Floor 5",
    "neighbourhoodName": "Engineering Zone",
    "personEmail": "john.smith@example.com",
    "personFullName": "John Smith",
    "reservationIsToday": false
  }
}

{
  "id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
  "type": "ReservationCancelled",
  "timestamp": "2024-01-15T10:15:00Z",
  "data": {
    "personAssetId": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    "personId": "550e8400-e29b-41d4-a716-446655440000",
    "assetId": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
    "assetName": "Desk A-101",
    "reservationStartTimeUtc": "2024-01-16T09:00:00Z",
    "reservationEndTimeUtc": "2024-01-16T17:00:00Z",
    "reservationStartTimeLocal": "2024-01-16T20:00:00",
    "reservationEndTimeLocal": "2024-01-17T04:00:00",
    "timezoneIana": "Australia/Sydney",
    "siteLevelName": "Level 5",
    "floorName": "Floor 5",
    "neighbourhoodName": "Engineering Zone",
    "personEmail": "john.smith@example.com",
    "personFullName": "John Smith",
    "cancelledAt": "2024-01-15T10:15:00Z",
    "cancelledBy": "john.smith@example.com"
  }
}

{
  "id": "c3d4e5f6-a7b8-9012-cdef-123456789012",
  "type": "CheckedIn",
  "timestamp": "2024-01-16T09:05:00Z",
  "data": {
    "personAssetId": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    "personId": "550e8400-e29b-41d4-a716-446655440000",
    "assetId": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
    "assetName": "Desk A-101",
    "checkInTimeUtc": "2024-01-16T09:05:00Z",
    "checkInTimeLocal": "2024-01-16T20:05:00",
    "expectedCheckOutTimeUtc": "2024-01-16T17:00:00Z",
    "expectedCheckOutTimeLocal": "2024-01-17T04:00:00",
    "timezoneIana": "Australia/Sydney",
    "timezoneDisplayName": "Australian Eastern Daylight Time",
    "siteLocationId": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "siteLocationName": "Sydney HQ",
    "siteLevelId": "8f14e45f-ceea-467f-a0e8-14db0148c3a1",
    "siteLevelName": "Level 5",
    "city": "Sydney",
    "region": "NSW",
    "country": "Australia",
    "personEmail": "john.smith@example.com",
    "personFullName": "John Smith",
    "firstName": "John",
    "lastName": "Smith",
    "fromReservation": true
  }
}

{
  "id": "d4e5f6a7-b8c9-0123-def0-234567890123",
  "type": "CheckedOut",
  "timestamp": "2024-01-16T17:30:00Z",
  "data": {
    "personAssetId": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    "personId": "550e8400-e29b-41d4-a716-446655440000",
    "assetId": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
    "assetName": "Desk A-101",
    "checkOutTimeUtc": "2024-01-16T17:30:00Z",
    "checkOutTimeLocal": "2024-01-17T04:30:00",
    "checkInTimeUtc": "2024-01-16T09:05:00Z",
    "checkInTimeLocal": "2024-01-16T20:05:00",
    "timezoneIana": "Australia/Sydney",
    "timezoneDisplayName": "Australian Eastern Daylight Time",
    "siteLocationId": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "siteLocationName": "Sydney HQ",
    "siteLevelId": "8f14e45f-ceea-467f-a0e8-14db0148c3a1",
    "siteLevelName": "Level 5",
    "city": "Sydney",
    "region": "NSW",
    "country": "Australia",
    "personEmail": "john.smith@example.com",
    "personFullName": "John Smith",
    "firstName": "John",
    "lastName": "Smith"
  }
}

{
  "id": "e5f6a7b8-c9d0-1234-ef01-345678901234",
  "type": "PersonStatusChanged",
  "timestamp": "2024-01-16T08:45:00Z",
  "data": {
    "personId": "550e8400-e29b-41d4-a716-446655440000",
    "personFullName": "John Smith",
    "personEmail": "john.smith@example.com",
    "oldPersonStatusId": "9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d",
    "oldPersonStatusName": "Remote",
    "oldWorkDayType": 2,
    "newPersonStatusId": "1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d",
    "newPersonStatusName": "In Office",
    "newWorkDayType": 1,
    "statusChangeMethod": 1,
    "statusChangedAtUtc": "2024-01-16T08:45:00Z",
    "personStatusComment": null,
    "personStatusExpiry": null,
    "isStatusConfirmed": true
  }
}