Build on YARDtwin

Authorization: Bearer $YARDTWIN_API_KEY

curl -s "https://yardtwin.com/api/v1/appointments?date=2026-10-01&limit=10" \
  -H "Authorization: Bearer $YARDTWIN_API_KEY"

{
  "event": "gate.checked_in",
  "source": "YARDtwin",
  "delivery_id": "6f1c0b0e-2d0a-4c1e-9a55-0c8f4f7e2a11",
  "timestamp": "2026-10-01T07:42:10.512Z",
  "site_id": "…",
  "data": { "…": "event-specific fields" }
}

const crypto = require('crypto');

// Express: capture the raw body, e.g. app.use(express.raw({ type: 'application/json' }))
function verifyYardtwin(req, secret) {
  const signature = req.get('X-YARDtwin-Signature');   // "sha256=<hex>"
  const timestamp = req.get('X-YARDtwin-Timestamp');   // unix seconds
  const body = req.body.toString('utf8');              // the exact bytes received
  if (!signature || !timestamp) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false; // 5-minute window

  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(body + ':' + timestamp)
    .digest('hex');
  const a = Buffer.from(signature);
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

import hashlib, hmac, time

def verify_yardtwin(raw_body: bytes, headers: dict, secret: str) -> bool:
    signature = headers.get("X-YARDtwin-Signature", "")   # "sha256=<hex>"
    timestamp = headers.get("X-YARDtwin-Timestamp", "")   # unix seconds
    if not signature or not timestamp:
        return False
    if abs(time.time() - int(timestamp)) > 300:            # 5-minute window
        return False
    message = raw_body + b":" + timestamp.encode()
    expected = "sha256=" + hmac.new(secret.encode(), message, hashlib.sha256).hexdigest()
    return hmac.compare_digest(signature, expected)

TS=$(date +%s)
BODY='{"event_type":"shipment_eta_update","data":{"reference":"PO-45001234","new_date":"2026-10-01","new_time":"09:30"}}'
SIG="sha256=$(printf '%s:%s' "$BODY" "$TS" | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET" -hex | sed 's/^.* //')"

curl -s -X POST "https://yardtwin.com/api/v1/integrations/$INTEGRATION_ID/webhook" \
  -H "Content-Type: application/json" \
  -H "X-Webhook-Timestamp: $TS" \
  -H "X-Webhook-Signature: $SIG" \
  -d "$BODY"