curl -X POST https://api.orbit.devotel.io/api/v1/webhooks/endpoints \
  -H "X-API-Key: dv_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://yourapp.com/webhooks/orbit-dlr",
    "events": ["message.sent", "message.delivered", "message.read", "message.failed"]
  }'

import express from "express";
import crypto from "node:crypto";

const DLR_EVENTS = new Set([
  "message.sent",
  "message.delivered",
  "message.read",
  "message.failed",
]);

const app = express();

app.post(
  "/webhooks/orbit-dlr",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const header = req.headers["x-orbit-signature"] ?? req.headers["x-devotel-signature"];
    const raw = req.body; // Buffer of the raw payload

    if (!header || !verifySignature(raw, String(header), process.env.ORBIT_WEBHOOK_SECRET)) {
      return res.status(401).json({ error: "Invalid signature" });
    }

    let event;
    try {
      event = JSON.parse(raw.toString("utf8"));
    } catch {
      return res.status(400).json({ error: "Missing event id" });
    }
    if (!event?.id) return res.status(400).json({ error: "Missing event id" });

    // Dedupe before any work — retries re-deliver the same id.
    if (!seenEvents.remember(event.id)) {
      return res.status(200).json({ received: true, duplicate: true });
    }

    // Non-DLR events on a shared endpoint are acked and dropped here.
    if (!DLR_EVENTS.has(event.type)) {
      return res.status(200).json({ received: true, skipped: true });
    }

    queue.enqueue(event);
    return res.status(200).json({ received: true });
  }
);

function verifySignature(rawBody, header, secret) {
  let t = null;
  const v1s = [];
  for (const part of header.split(",")) {
    const [key, value] = part.trim().split("=");
    if (key === "t") t = value;
    else if (key === "v1") v1s.push(value);
  }
  if (!t || v1s.length === 0) return false;

  const age = Math.floor(Date.now() / 1000) - Number(t);
  if (!Number.isFinite(age) || age < 0 || age > 5 * 60) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${rawBody.toString("utf8")}`, "utf8")
    .digest("hex");

  return v1s.some((candidate) => {
    const a = Buffer.from(candidate, "hex");
    const b = Buffer.from(expected, "hex");
    return a.length === b.length && crypto.timingSafeEqual(a, b);
  });
}

switch (event.type) {
  case "message.sent":
    return markSent(event.data.message_id);
  case "message.delivered":
    return markDelivered(event.data.message_id);
  case "message.read":
    return markRead(event.data.message_id);
  case "message.failed":
    return resolveFailure(event.data.message_id, event.data.status, event.data.error_code);
}

import os
import hmac
import hashlib
import time
import json

from flask import Flask, request, jsonify

DLR_EVENTS = {
    "message.sent",
    "message.delivered",
    "message.read",
    "message.failed",
}

app = Flask(__name__)
SECRET = os.environ["ORBIT_WEBHOOK_SECRET"]


@app.route("/webhooks/orbit-dlr", methods=["POST"])
def handle():
    header = request.headers.get("X-Orbit-Signature") or request.headers.get(
        "X-Devotel-Signature", ""
    )
    raw = request.get_data()  # raw bytes, untouched by any parser
    if not verify_signature(raw, header, SECRET):
        return jsonify({"error": "Invalid signature"}), 401

    try:
        event = json.loads(raw)
    except ValueError:
        return jsonify({"error": "Missing event id"}), 400

    event_id = event.get("id")
    if not event_id:
        return jsonify({"error": "Missing event id"}), 400

    if not seen_events.remember(event_id):
        return jsonify({"received": True, "duplicate": True}), 200

    if event.get("type") not in DLR_EVENTS:
        return jsonify({"received": True, "skipped": True}), 200

    queue.enqueue(event_id=event_id, body=event)
    return jsonify({"received": True}), 200


def verify_signature(raw_body: bytes, header: str, secret: str) -> bool:
    t = None
    v1s = []
    for part in header.split(","):
        part = part.strip()
        if "=" not in part:
            continue
        key, _, value = part.partition("=")
        if key == "t":
            t = value
        elif key == "v1":
            v1s.append(value)
    if not t or not v1s:
        return False

    age = int(time.time()) - int(t)
    if age < 0 or age > 5 * 60:
        return False

    signed = f"{t}.".encode("utf-8") + raw_body
    expected = hmac.new(secret.encode("utf-8"), signed, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(candidate, expected) for candidate in v1s)

curl -X POST https://api.orbit.devotel.io/api/v1/messages \
  -H "X-API-Key: dv_test_sk_..." \
  -H "Content-Type: application/json" \
  -d '{ "to": "+15005550003", "from": "+15550100", "body": "DLR consumer rehearsal" }'