Bulk operations

import express from "express";
import crypto from "crypto";

const app = express();
const KEY = process.env.ENCRATA_API_KEY;
const SECRET = process.env.ENCRATA_WEBHOOK_SECRET;

// Capture the raw body so the signature can be verified.
app.post("/webhooks/encrata", express.raw({ type: "*/*" }), async (req, res) => {
  const signature = req.get("X-Encrata-Signature") || "";
  const expected = crypto.createHmac("sha256", SECRET).update(req.body).digest("hex");
  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) {
    return res.status(400).json({ error: "bad signature" });
  }

  const { event, data } = JSON.parse(req.body.toString());
  res.sendStatus(200); // ack fast; do the download out of band

  if (event === "bulk.completed" && data.download_url) {
    const file = await fetch(data.download_url, {
      headers: { Authorization: `Bearer ${KEY}` },
      redirect: "follow",
    });
    const csv = await file.text();
    // ...persist or process csv...
  }
});

app.listen(3000);

import hmac, hashlib, os, requests
from flask import Flask, request, abort

app = Flask(__name__)
KEY = os.environ["ENCRATA_API_KEY"]
SECRET = os.environ["ENCRATA_WEBHOOK_SECRET"].encode()

@app.post("/webhooks/encrata")
def receive():
    body = request.get_data()
    signature = request.headers.get("X-Encrata-Signature", "")
    expected = hmac.new(SECRET, body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, signature):
        abort(400)

    payload = request.get_json()
    if payload["event"] == "bulk.completed" and payload["data"].get("download_url"):
        file = requests.get(
            payload["data"]["download_url"],
            headers={"Authorization": f"Bearer {KEY}"},
            allow_redirects=True,
        )
        # ...persist or process file.content...
    return "", 200