# Cyberimpact Webhooks

Cyberimpact is an email marketing platform. Its marketing automation scenarios have a
**Send a webhook** action that POSTs a JSON body to a URL you choose when a contact reaches that
step. Webhooks are **not signed**. You authenticate them with a secret header: you add a
key-value pair to the action's webhook headers, and your endpoint checks that header on every
request.

## When to Use This Skill

* How do I receive Cyberimpact webhooks?
* How do I authenticate a Cyberimpact "Send a webhook" action?
* Does Cyberimpact sign webhook payloads? (No: use a secret header you define)
* How do I handle the `automation.webhook.send` event and its contact data?
* Why does my Cyberimpact webhook endpoint return 401?

## Verification (core)

```javascript
const crypto = require('crypto');

// Hash both sides: equal-length buffers, so timingSafeEqual never throws.
function safeEqual(a, b) {
  const ha = crypto.createHash('sha256').update(String(a)).digest();
  const hb = crypto.createHash('sha256').update(String(b)).digest();
  return crypto.timingSafeEqual(ha, hb);
}

function verifyCyberimpactRequest(headers, {
  name = process.env.CYBERIMPACT_WEBHOOK_HEADER || 'Authorization',
  secret = process.env.CYBERIMPACT_WEBHOOK_SECRET,
} = {}) {
  if (!secret) return false;                   // never accept when unconfigured
  const received = headers[name.toLowerCase()]; // Node lowercases header names
  return Boolean(received) && safeEqual(received, secret); // WHOLE value, exact match
}

```

* You choose the header. In the action's **Headers** section add a key-value pair. **Use a simple
  header name without spaces or special characters, such as `Authorization`.** Cyberimpact does
  not allow spaces or special characters in header keys.
* The expected value is the exact, whole header value, including any `Bearer ` prefix you typed.
  Compare the whole value; do not strip or parse a prefix.
* The header name is read from `CYBERIMPACT_WEBHOOK_HEADER` (default `Authorization`) and
  matched case-insensitively. The value comes from `CYBERIMPACT_WEBHOOK_SECRET`.
* Return `401` for a missing header or a mismatch, `400` for a body that isn't a JSON object,
  `200` once handled. The **Test** button expects `200`.
* Read the body raw (`express.raw({ type: '*/*' })`) and authenticate before parsing it.

> **Security note:** a static shared credential authenticates the sender, not the body, and gives
> no replay protection (there is no signature and no timestamp). Use HTTPS only, and rotate the
> credential in both the scenario and your endpoint if it leaks.

> **For complete handlers with tests**, see [examples/express/](https://github.com/hookdeck/webhook-skills/tree/main/skills/cyberimpact-webhooks/examples/express/), [examples/nextjs/](https://github.com/hookdeck/webhook-skills/tree/main/skills/cyberimpact-webhooks/examples/nextjs/), [examples/fastapi/](https://github.com/hookdeck/webhook-skills/tree/main/skills/cyberimpact-webhooks/examples/fastapi/).

## Event Types

Every request has `event` set to `automation.webhook.send`. What differs is the `data` the
scenario author selected.

| Event | Sent When |
| --- | --- |
| `automation.webhook.send` | A contact reaches a **Send a webhook** step in a marketing automation scenario |

Body shape (the Test button sends this):

```json
{
  "id": "test_evt_GppedVq2CWTWxUUxrm26bic0C",
  "event": "automation.webhook.send",
  "timestamp": "2024-05-28T12:56:40Z",
  "idClient": 3,
  "data": { "type": "member", "id": 54321, "email": "john.doe@example.org", "firstname": "John", "lastname": "Doe" }
}

```

Real deliveries add the contact fields and the key-value pairs chosen in **Data to be
transmitted** and **Additional information**. Trigger a test delivery to see the exact shape.

## Environment Variables

```bash
CYBERIMPACT_WEBHOOK_HEADER=Authorization        # header key you added in the webhook headers
CYBERIMPACT_WEBHOOK_SECRET=your-secret-value    # exact, whole header value (include "Bearer " if you typed it)

```

## Local Development

Cyberimpact can't reach `localhost`. Tunnel with the Hookdeck CLI (no account required):

```bash
npx hookdeck-cli listen 3000 cyberimpact --path /webhooks/cyberimpact

```

Use the printed URL as the webhook URL in the scenario action.

## Resources

* [references/overview.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/cyberimpact-webhooks/references/overview.md) - What Cyberimpact webhooks are, event and payload shape
* [references/setup.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/cyberimpact-webhooks/references/setup.md) - Add the Send a webhook action and the secret header
* [references/verification.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/cyberimpact-webhooks/references/verification.md) - Header check details, gotchas, debugging 401s
* [examples/](https://github.com/hookdeck/webhook-skills/tree/main/skills/cyberimpact-webhooks/examples/) - Runnable Express, Next.js and FastAPI handlers with tests