curl -X POST https://api.dokubrain.com/api/v1/webhooks \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.com/webhooks/dokubrain",
    "events": ["document.processed", "workflow.completed"],
    "secret": "whsec_your_signing_secret"
  }'

{
  "id": "evt_abc123",
  "type": "document.processed",
  "createdAt": "2026-03-15T10:30:15Z",
  "data": {
    "documentId": "doc_abc123",
    "filename": "invoice.pdf",
    "status": "completed",
    "classification": {
      "type": "invoice",
      "confidence": 0.97
    }
  }
}

const crypto = require('crypto');
 
function verifyWebhookSignature(rawBody, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
 
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(`sha256=${expected}`)
  );
}
 
// In your Express/Fastify handler:
app.post('/webhooks/dokubrain', (req, res) => {
  const signature = req.headers['x-dokubrain-signature'];
  if (!verifyWebhookSignature(req.rawBody, signature, WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }
  // Process the event
  const event = req.body;
  console.log(`Received ${event.type}:`, event.data);
  res.status(200).send('OK');
});