Webhooks

mutation {
  createWebhook(input: {
    url: "https://your-app.com/webhooks/heychocolate"
    events: [PRODUCT_IMPACT_UPDATED, ORDER_CARBON_CALCULATED, DPP_GENERATED]
    secret: "whsec_your_signing_secret"
  }) {
    id
    url
    events
    status
  }
}

{
  "id": "evt_abc123",
  "type": "product.impact_updated",
  "createdAt": "2025-09-01T12:00:00Z",
  "data": {
    "productId": "prod_abc123",
    "previousScore": { "co2Equivalent": 14.2 },
    "newScore": { "co2Equivalent": 12.4 },
    "reason": "EPD data updated"
  }
}

import crypto from 'crypto';

function verifyWebhookSignature(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(`sha256=${expected}`)
  );
}

query {
  webhooks {
    id
    url
    events
    status
    lastDelivery { status responseCode deliveredAt }
  }
}

mutation {
  deleteWebhook(id: "wh_abc123") { success }
}