Migrate from 360dialog

curl https://api.kapso.ai/platform/v1/whatsapp/phone_numbers \
  -H "X-API-Key: YOUR_API_KEY"

{
  "data": [
    {
      "id": "1234567890",
      "phone_number_id": "1234567890",
      "name": "Support Line",
      "business_account_id": "98765432109",
      "display_phone_number": "+1 555-123-4567",
      "quality_rating": "GREEN",
      "throughput_tier": "TIER_10K",
      "status": "CONNECTED"
    }
  ]
}

curl -X POST https://api.kapso.ai/platform/v1/whatsapp/phone_numbers/1234567890/webhooks \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "whatsapp_webhook": {
      "kind": "meta",
      "url": "https://yourapp.com/webhooks/whatsapp",
      "secret_key": "your-signing-secret"
    }
  }'

curl -X POST https://api.kapso.ai/platform/v1/whatsapp/phone_numbers/1234567890/webhooks \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "whatsapp_webhook": {
      "url": "https://yourapp.com/webhooks/whatsapp",
      "events": [
        "whatsapp.message.received",
        "whatsapp.message.sent",
        "whatsapp.message.delivered",
        "whatsapp.message.read",
        "whatsapp.message.failed"
      ],
      "secret_key": "your-signing-secret"
    }
  }'

const crypto = require('crypto');

// express.raw, not express.json: Kapso signs the exact bytes it sent, and
// re-serializing a parsed body does not reproduce them
app.post('/webhooks/whatsapp', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(req.body)
    .digest('hex');

  const a = Buffer.from(expected, 'utf8');
  const b = Buffer.from(req.headers['x-webhook-signature'] ?? '', 'utf8');

  // timingSafeEqual throws on length mismatch, so compare lengths first
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body);
  res.sendStatus(200);
});

curl -X POST https://waba-v2.360dialog.io/message_templates \
  -H "D360-API-KEY: YOUR_CHANNEL_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "order_update",
    "language": "en_US",
    "category": "UTILITY",
    "components": [
      {
        "type": "BODY",
        "text": "Hi {{1}}, your order is confirmed.",
        "example": { "body_text": [["John"]] }
      }
    ]
  }'

curl -X POST https://api.kapso.ai/meta/whatsapp/v24.0/98765432109/message_templates \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "order_update",
    "category": "UTILITY",
    "language": "en_US",
    "components": [
      {
        "type": "BODY",
        "text": "Hi {{1}}, your order is confirmed.",
        "example": { "body_text": [["John"]] }
      }
    ]
  }'

curl -X POST https://api.kapso.ai/platform/v1/customers \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"customer": {"name": "Acme Corporation", "external_customer_id": "CUS-12345"}}'

curl -X POST https://api.kapso.ai/platform/v1/customers/CUSTOMER_ID/setup_links \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "setup_link": {
      "success_redirect_url": "https://your-app.com/whatsapp/success",
      "meta_billing_mode": "partner_managed"
    }
  }'

const crypto = require('crypto');
const express = require('express');

const app = express();

// Any durable queue works. 360dialog retried webhooks for days; Kapso
// stops after about 50 seconds, so the queue is what absorbs downtime.
const queue = require('./queue');

const KAPSO = 'https://api.kapso.ai/meta/whatsapp/v24.0';
const headers = {
  'X-API-Key': process.env.KAPSO_API_KEY, // was: D360-API-KEY per number
  'Content-Type': 'application/json',
};

// 360dialog: POST https://waba-v2.360dialog.io/messages, sender implied by key.
// Kapso: same body, sender in the path.
async function sendText({ phoneNumberId, to, text }) {
  const res = await fetch(`${KAPSO}/${phoneNumberId}/messages`, {
    method: 'POST',
    headers,
    body: JSON.stringify({
      messaging_product: 'whatsapp',
      to,
      type: 'text',
      text: { body: text },
    }),
  });
  const body = await res.json();

  if (!res.ok) {
    throw new Error(`Send failed (${res.status}): ${JSON.stringify(body.error ?? body)}`);
  }

  return body.messages[0].id; // wamid, same as before
}

// kind: "meta" webhook. The payload is Meta's envelope, exactly what
// 360dialog forwarded, so the parsing below is your existing code.
app.post('/webhooks/whatsapp', express.raw({ type: 'application/json' }), async (req, res) => {
  // New: 360dialog sent no signature. Kapso signs the raw body.
  const expected = crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(req.body)
    .digest('hex');

  const a = Buffer.from(expected, 'utf8');
  const b = Buffer.from(req.headers['x-webhook-signature'] ?? '', 'utf8');

  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).send('Invalid signature');
  }

  const payload = JSON.parse(req.body);
  const idempotencyKey = req.headers['x-idempotency-key'];

  for (const entry of payload.entry ?? []) {
    for (const change of entry.changes ?? []) {
      const value = change.value ?? {};

      for (const message of value.messages ?? []) {
        await queue.add('inbound', {
          idempotencyKey,
          // `from` can be absent on a BSUID-only contact, so carry the
          // scoped IDs too or the job cannot tell you who wrote in.
          from: message.from ?? null,
          fromUserId: message.from_user_id ?? null,
          fromParentUserId: message.from_parent_user_id ?? null,
          username: message.username ?? null,
          text: message.text?.body,
          phoneNumberId: value.metadata?.phone_number_id,
        });
      }

      for (const status of value.statuses ?? []) {
        await queue.add('status', {
          idempotencyKey,
          id: status.id,
          status: status.status,
          errors: status.errors ?? [],
        });
      }
    }
  }

  res.sendStatus(200);
});