POST /api/v1/organization/webhooks

{
  "url": "https://tu-servidor.com/webhooks/coordinalo",
  "secret": "tu-secret-key",
  "events": ["session.*", "payment.*", "client.created"]
}

{
  "event": "session.completed",
  "data": {
    "sessionId": "sess_123abc",
    "previousStatus": "in_progress",
    "newStatus": "completed",
    "completedAt": "2026-01-15T11:05:00Z"
  },
  "timestamp": "2026-01-15T11:05:01Z",
  "signature": "sha256=..."
}

const crypto = require('crypto');

function verifySignature(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return `sha256=${expected}` === signature;
}