Initial commit: sap-webhook-api

API NestJS que recibe el Webhook Messenger de SAP Business One (CloudEvents), valida HMAC opcional y guarda cada notificacion local (data/events/) e inserta en Postgres (webhook_events). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-16 07:41:25 -05:00
commit 5e0df73477
@@ -0,0 +1,199 @@
+@url=https://sap10:50000/b1s/v2
+
+###
+# @no-reject-unauthorized
+POST {{url}}/Login
+Content-Type : application/json
+
+{
+    "CompanyDB":"SBODemoCL",
+    "UserName": "manager",
+    "Password":"mngr"
+}
+
+###
+# @no-reject-unauthorized
+GET {{url}}/CompanyService_GetAdminInfo
+
+
+###
+# @no-reject-unauthorized
+POST {{url}}/CompanyService_UpdateAdminInfo
+Content-Type : application/json
+
+{
+    "AdminInfo":{
+        "EnableWebhook": "tYES"
+    }
+}
+
+###
+# @no-reject-unauthorized
+GET {{url}}/EventSubscriptionsService_GetEventCatalog
+
+
+###
+# @no-reject-unauthorized
+POST {{url}}/EventSubscriptions
+Content-Type : application/json
+
+{
+    "WebhookID": "SapWebhookApiTest",
+    "WebhookURL": "https://192.168.1.166:3000/webhooks/sap",
+    "AuthenticationType": "None",
+    "Handshake": "tNO",
+    "EventCollection": [
+        {
+            "BusinessObject": "Orders",
+            "TransactionType": "Created"
+        }
+    ]
+}
+
+###
+# @no-reject-unauthorized
+GET {{url}}/EventSubscriptions
+
+###
+# ⚠ El Service Layer NO permite cambiar AuthenticationType con PATCH sobre
+# una suscripción existente — hay que Pause + Delete (arriba/abajo) y
+# volver a crearla con este POST. AuthenticationCred para HMAC no es el
+# secreto pelado: es un string con JSON embebido {"Key": "...", "Algorithm": "hmacsha256"}.
+# Con esta config, SAP firma cada POST con HMAC-SHA256 usando "Key" y lo
+# manda en el header X-B1-Webhook-Signature.
+# @no-reject-unauthorized
+POST {{url}}/EventSubscriptions
+Content-Type : application/json
+
+{
+    "WebhookID": "SapWebhookApiTest",
+    "WebhookURL": "https://192.168.1.166:3000/webhooks/sap",
+    "VerifyCertificate": "tNO",
+    "AuthenticationType": "HMAC",
+    "AuthenticationCred": "{\"Key\": \"6Umq/cD6YQ4S8LKDOT33oDB6WifYXQFRQ4oRbIGzH0c=\", \"Algorithm\": \"hmacsha256\"}",
+    "Handshake": "tNO",
+    "EventCollection": [
+        {
+            "BusinessObject": "Orders",
+            "TransactionType": "Created"
+        }
+    ]
+}
+
+###
+# @no-reject-unauthorized
+DELETE {{url}}/EventSubscriptions('SapWebhookApiTest')
+
+###
+# To remove an event (such as Invoices.Updated) from the subscription, 
+# send a PATCH request with the updated EventCollection that excludes
+# the event you want to remove. Include the special header 
+# B1S-ReplaceCollectionsOnPatch to indicate a full replacement of the 
+# collection.
+# @no-reject-unauthorized
+PATCH {{url}}/EventSubscriptions('SapWebhookApiTest')
+B1S-ReplaceCollectionsOnPatch: true
+Content-Type : application/json
+
+{
+    "EventCollection": [
+        {
+            "BusinessObject": "BusinessPartners",
+            "TransactionType": "Created"
+        },
+        {
+            "BusinessObject": "BusinessPartners",
+            "TransactionType": "Updated"
+        },
+        {
+            "BusinessObject": "BusinessPartners",
+            "TransactionType": "Deleted"
+        },
+        {
+            "BusinessObject": "Orders",
+            "TransactionType": "Created"
+        },
+        {
+            "BusinessObject": "ProfitCenters",
+            "TransactionType": "Created"
+        },
+        {
+            "BusinessObject": "ProfitCenters",
+            "TransactionType": "Updated"
+        },
+        {
+            "BusinessObject": "ProfitCenters",
+            "TransactionType": "Deleted"
+        },
+        {
+            "BusinessObject": "SalesPersons",
+            "TransactionType": "Created"
+        },
+        {
+            "BusinessObject": "SalesPersons",
+            "TransactionType": "Updated"
+        },
+        {
+            "BusinessObject": "SalesPersons",
+            "TransactionType": "Deleted"
+        },
+        {
+            "BusinessObject": "ChartOfAccounts",
+            "TransactionType": "Created"
+        },
+        {
+            "BusinessObject": "ChartOfAccounts",
+            "TransactionType": "Updated"
+        },
+        {
+            "BusinessObject": "ChartOfAccounts",
+            "TransactionType": "Deleted"
+        },
+        {
+            "BusinessObject": "Items",
+            "TransactionType": "Created"
+        },
+        {
+            "BusinessObject": "Items",
+            "TransactionType": "Updated"
+        },
+        {
+            "BusinessObject": "Items",
+            "TransactionType": "Deleted"
+        },
+        {
+            "BusinessObject": "JournalEntries",
+            "TransactionType": "Created"
+        },
+        {
+            "BusinessObject": "JournalEntries",
+            "TransactionType": "Updated"
+        },
+        {
+            "BusinessObject": "JournalEntries",
+            "TransactionType": "Cancelled"
+        }
+    ]
+}
+
+###
+# If a webhook subscription is deactivated due to errors, such as 
+# repeated delivery failures, you can resume it by sending a POST request 
+# to the EventSubscriptions('{WebhookID}')/Resume endpoint.
+# @no-reject-unauthorized
+POST {{url}}/EventSubscriptions('SapWebhookApiTest')/Resume
+
+###
+# To pause an active event subscription, send a POST request to the EventSubscriptions('{WebhookID}')/Pause endpoint.
+# @no-reject-unauthorized
+POST {{url}}/EventSubscriptions('SapWebhookApiTest')/Pause
+
+###
+# If a webhook subscription requires handshake verification, you can manually initiate the handshake process by sending a POST request to the EventSubscriptions('{WebhookID}')/Handshake endpoint.
+# @no-reject-unauthorized
+POST {{url}}/EventSubscriptions('SapWebhookApiTest')/Handshake
+
+###
+# To replay missed event notifications for a specific webhook subscription, send a POST request to the EventSubscriptions('{WebhookID}')/Replay endpoint:
+# @no-reject-unauthorized
+POST {{url}}/EventSubscriptions('SapWebhookApiTest')/Replay