Your website's enquiries, in Yamo

curl https://api.yamo.travel/agency-api/v1/enquiries \
  -H "Authorization: Bearer yamo_sk_…" \
  -H "Content-Type: application/json" \
  -d '{
    "fullName": "Naledi Khumalo",
    "email": "naledi@example.com",
    "phone": "+27821234567",
    "destination": "Zanzibar, Tanzania",
    "datesLabel": "December 2026",
    "days": 7,
    "partySize": 2,
    "budgetCents": 2500000,
    "brief": "Beach and a spice tour, flying from Johannesburg",
    "externalRef": "web-1042"
  }'

{
  "id": "2808dbfc-d0ab-40d4-b2aa-62ecb1723254",
  "externalRef": "web-1042",
  "source": "agency",
  "channel": "site",
  "status": "new",
  "closed": false,
  "traveller": { "name": "Naledi Khumalo", "email": "naledi@example.com", "phone": "+27821234567" },
  "destination": "Zanzibar, Tanzania",
  "datesLabel": "December 2026",
  "days": 7,
  "partySize": 2,
  "budgetCents": 2500000,
  "preferenceChips": [],
  "brief": "Beach and a spice tour",
  "details": { "adults": 2, "from": "Johannesburg", "travel": "fly", "flights": "book", "car": "driver" },
  "proposal": null,
  "tripId": null,
  "bookingId": null,
  "createdAt": "2026-10-20T12:00:00.000Z",
  "updatedAt": "2026-10-20T12:00:00.000Z"
}

{
  "id": "evt_f201bb415fc44f43b47d2a089c8e08b1",
  "type": "payment.received",
  "createdAt": "2026-10-22T09:14:03.000Z",
  "agency": { "id": "…", "slug": "your-slug" },
  "data": {
    "payment": {
      "id": "…", "label": "Deposit · secures your seat",
      "amountCents": 500000, "currency": "ZAR",
      "paidVia": "yoco", "paidAt": "2026-10-22T09:14:02.000Z"
    },
    "booking": {
      "id": "…", "tripId": "…", "tripName": "Zanzibar, Tanzania", "tripKind": "tailored",
      "startDate": null, "partySize": 2, "status": "approved",
      "source": "agency", "sourceRef": "agency.your-slug.site",
      "enquiryId": "2808dbfc-d0ab-40d4-b2aa-62ecb1723254",
      "traveller": { "name": "Naledi Khumalo", "email": "naledi@example.com", "phone": "+27821234567" },
      "totalCents": 4000000, "paidCents": 500000, "currency": "ZAR"
    }
  }
}

// Express: keep the raw body, e.g. app.post('/hooks/yamo', express.raw({ type: 'application/json' }), handler)
import { createHmac, timingSafeEqual } from 'node:crypto';

export function fromYamo(headers, rawBody, secret) {
  const id = headers['webhook-id'];
  const ts = headers['webhook-timestamp'];
  const sig = headers['webhook-signature'] || '';
  if (!id || !ts || Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64');
  const expected = createHmac('sha256', key).update(`${id}.${ts}.${rawBody}`).digest();
  return sig.split(' ').some((part) => {
    const given = Buffer.from(part.replace(/^v1,/, ''), 'base64');
    return given.length === expected.length && timingSafeEqual(given, expected);
  });
}

// In the handler: answer fast, do the work after.
// if (!fromYamo(req.headers, req.body.toString('utf8'), process.env.YAMO_WEBHOOK_SECRET)) return res.sendStatus(401);
// const event = JSON.parse(req.body); res.sendStatus(200); handle(event);

<?php
// WordPress or plain PHP: read the raw body before anything parses it.
function from_yamo(array $headers, string $rawBody, string $secret): bool {
  $h = array_change_key_case($headers, CASE_LOWER);
  $id = $h['webhook-id'] ?? '';
  $ts = $h['webhook-timestamp'] ?? '';
  if ($id === '' || abs(time() - (int) $ts) > 300) return false;
  $key = base64_decode(preg_replace('/^whsec_/', '', $secret));
  $expected = base64_encode(hash_hmac('sha256', "$id.$ts.$rawBody", $key, true));
  foreach (explode(' ', $h['webhook-signature'] ?? '') as $part) {
    if (hash_equals($expected, preg_replace('/^v1,/', '', $part))) return true;
  }
  return false;
}

$raw = file_get_contents('php://input');
if (!from_yamo(getallheaders(), $raw, getenv('YAMO_WEBHOOK_SECRET'))) { http_response_code(401); exit; }
$event = json_decode($raw, true);
http_response_code(200);
// switch ($event['type']) { case 'payment.received': … }