Connect API

import crypto from "node:crypto";

const tenantSlug = "your-tenant-slug";
const keyPrefix = process.env.HOLIDAYOS_CONNECT_KEY;      // hc_live_…
const connectSecret = process.env.HOLIDAYOS_CONNECT_SECRET; // sk_…

// Sign the EXACT bytes you transmit. Serialize once, reuse the string —
// re-serializing for the request can reorder keys and break the signature.
const rawBody = JSON.stringify(payload);
const timestamp = Math.floor(Date.now() / 1000);
const digest = crypto
  .createHmac("sha256", connectSecret)
  .update(`${timestamp}.${rawBody}`)
  .digest("hex");

await fetch("https://api.new.holidayos.ai/api/v1/crm/connect/events", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-Connect-Key": keyPrefix,
    "X-Connect-Tenant": tenantSlug,
    "X-Connect-Signature": `t=${timestamp},v1=${digest}`
  },
  body: rawBody
});

BODY='{"events":[{"specVersion":"1.0","eventId":"evt_smoke_1","eventType":"enquiry.submitted","occurredAt":"2026-08-23T09:15:00Z","tenant":"your-tenant-slug","origin":"source-system","actor":{"type":"contact","email":"traveler@example.com","name":"Ana Silva"},"payload":{"destination":"Bali"}}]}'
TS=$(date +%s)
SIG=$(printf '%s.%s' "$TS" "$BODY" | openssl dgst -sha256 -hmac "$HOLIDAYOS_CONNECT_SECRET" -hex | sed 's/^.* //')

curl -X POST "https://api.new.holidayos.ai/api/v1/crm/connect/events" \
  -H "Content-Type: application/json" \
  -H "X-Connect-Key: $HOLIDAYOS_CONNECT_KEY" \
  -H "X-Connect-Tenant: your-tenant-slug" \
  -H "X-Connect-Signature: t=$TS,v1=$SIG" \
  -d "$BODY"

{
  "events": [
    {
      "specVersion": "1.0",
      "eventId": "source_event_id",
      "eventType": "enquiry.submitted",
      "occurredAt": "2026-08-23T09:15:00Z",
      "tenant": "your-tenant-slug",
      "origin": "source-system",
      "actor": {
        "type": "contact",
        "email": "traveler@example.com",
        "name": "Ana Silva",
        "phone": "+60123456789"
      },
      "payload": {
        "destination": "Bali",
        "travelDates": {
          "startDate": "2026-11-04",
          "endDate": "2026-11-10"
        },
        "party": { "adults": 3, "children": 0, "rooms": 1 },
        "message": "Customer requested advisor pricing before checkout.",
        "quote": { "status": "pending", "currency": "USD" },
        "attribution": {
          "source": "google",
          "medium": "cpc",
          "campaign": "bali-nov",
          "term": "bali holiday packages",
          "landingPath": "/campaign"
        }
      }
    }
  ]
}

{
  "accepted": 1,
  "duplicate": 0,
  "failed": 0,
  "results": [
    {
      "eventId": "source_event_id",
      "status": "accepted",
      "clientId": "6ab3d852869e40b4db978f8e",
      "leadId": "6ab8e3597a5f4efc2b5258cc",
      "tripId": "6ab8e3597a5f4efc2b5258ef"
    }
  ]
}

import crypto from "node:crypto";

const tenantSlug = "your-tenant-slug";
const keyPrefix = process.env.HOLIDAYOS_CONNECT_KEY;      // hc_live_…
const connectSecret = process.env.HOLIDAYOS_CONNECT_SECRET; // sk_…

async function connect(method, path, body, headers = {}) {
  const url = new URL(path, "https://api.new.holidayos.ai");
  const target = url.pathname + url.search; // sign exactly what you request
  const rawBody = body === undefined ? "" : JSON.stringify(body);
  const timestamp = Math.floor(Date.now() / 1000);
  const v2 = crypto
    .createHmac("sha256", connectSecret)
    .update(`${timestamp}.${method}.${target}.${rawBody}`)
    .digest("hex");
  const res = await fetch(url, {
    method,
    headers: {
      ...(rawBody ? { "Content-Type": "application/json" } : {}),
      "X-Connect-Key": keyPrefix,
      "X-Connect-Tenant": tenantSlug,
      "X-Connect-Signature": `t=${timestamp},v2=${v2}`,
      ...headers,
    },
    body: rawBody || undefined,
  });
  return { status: res.status, etag: res.headers.get("etag"), body: await res.json() };
}

// The customer changed their dates on your site:
const { data: trip } = (await connect("GET", "/api/v1/crm/connect/leads/LEAD_ID/trip")).body;
await connect(
  "PATCH",
  "/api/v1/crm/connect/leads/LEAD_ID/trip",
  { travelDates: { startDate: "2026-12-01", endDate: "2026-12-07" }, changeSummary: "Customer moved the trip" },
  { "If-Match": `"${trip.updatedAt}"` },
);

BODY='{"name":"Ana Silva","email":"ana@example.com","externalId":"user_8841"}'
TS=$(date +%s)
SIG=$(printf '%s.%s.%s.%s' "$TS" "POST" "/api/v1/crm/connect/clients" "$BODY" | openssl dgst -sha256 -hmac "$HOLIDAYOS_CONNECT_SECRET" -hex | sed 's/^.* //')

curl -X POST "https://api.new.holidayos.ai/api/v1/crm/connect/clients" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: signup-user_8841" \
  -H "X-Connect-Key: $HOLIDAYOS_CONNECT_KEY" \
  -H "X-Connect-Tenant: your-tenant-slug" \
  -H "X-Connect-Signature: t=$TS,v2=$SIG" \
  -d "$BODY"

{
  "id": "6ab3d852869e40b4db978f8e",
  "name": "Ana Silva",
  "email": "ana@example.com",
  "phone": "+60123456789",
  "company": null,
  "externalId": "user_8841",
  "marketingOptIn": true,
  "clientType": "individual",
  "travelers": [
    {
      "name": "Leo Silva",
      "type": "child",
      "age": 9,
      "email": null,
      "phone": null
    }
  ],
  "createdAt": "2026-10-07T09:04:37.000Z",
  "updatedAt": "2026-10-07T09:04:37.000Z"
}

{
  "id": "6ab8e3597a5f4efc2b5258cc",
  "enquiryNumber": "HOS-2026-000412",
  "title": "Ana Silva — Bali",
  "stage": "inquiry",
  "followUp": false,
  "clientId": "6ab3d852869e40b4db978f8e",
  "tripId": "6ab8e3597a5f4efc2b5258ef",
  "externalId": "enquiry_2207",
  "owner": {
    "email": "meera@youragency.com",
    "name": "Meera"
  },
  "destination": "Bali",
  "travelDates": {
    "startDate": "2026-11-04",
    "endDate": "2026-11-10"
  },
  "party": {
    "adults": 2,
    "children": 1,
    "childAges": [
      7
    ],
    "rooms": 1
  },
  "budget": {
    "amount": null,
    "currency": null,
    "notes": "around $3k per person"
  },
  "createdAt": "2026-10-07T09:05:12.000Z",
  "updatedAt": "2026-10-07T09:05:13.000Z"
}

{
  "id": "6ab8e3597a5f4efc2b5258ef",
  "leadId": "6ab8e3597a5f4efc2b5258cc",
  "enquiryNumber": "HOS-2026-000412",
  "title": "Ana Silva — Bali",
  "stage": "inquiry",
  "destination": "Bali",
  "travelDates": {
    "startDate": "2026-12-01",
    "endDate": "2026-12-07"
  },
  "party": {
    "adults": 3,
    "children": 1,
    "childAges": [
      7
    ],
    "rooms": 1
  },
  "budget": {
    "amount": null,
    "currency": null,
    "notes": "around $3k per person"
  },
  "guestNationality": null,
  "owner": {
    "email": "meera@youragency.com",
    "name": "Meera"
  },
  "proposal": {
    "status": "draft",
    "sentAt": null
  },
  "createdAt": "2026-10-07T09:05:13.000Z",
  "updatedAt": "2026-10-08T14:20:00.000Z"
}

POST https://your-system.example.com/hooks/holidayos
Content-Type: application/json
X-Connect-Signature: t=1787654321,v1=<hex>
X-Connect-Tenant: your-tenant-slug
X-Connect-Event: proposal.sent
X-Connect-Delivery: dlv_01H…

{
  "specVersion": "1.0",
  "eventId": "5f1c…-uuid",
  "eventType": "proposal.sent",
  "occurredAt": "2026-08-23T09:15:00Z",
  "tenant": "your-tenant-slug",
  "origin": "crm",
  "actor": {
    "type": "contact",
    "email": "traveler@example.com",
    "name": "Ana Silva"
  },
  "payload": {
    "proposalId": "prop_01H…",
    "tripId": "trip_01H…",
    "title": "Bali — 6 nights",
    "proposalUrl": "https://app.holidayos.ai/p/…",
    "channel": "email"
  }
}

import crypto from "node:crypto";

// Read the RAW body — a JSON-parsing middleware that re-serializes will
// change the bytes and every signature will fail to verify.
export function verify(rawBody, signatureHeader, secret) {
  const parts = Object.fromEntries(
    signatureHeader.split(",").map((p) => p.split("=").map((s) => s.trim())),
  );
  const age = Math.abs(Math.floor(Date.now() / 1000) - Number(parts.t));
  if (!Number.isFinite(age) || age > 300) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${parts.t}.${rawBody}`)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(parts.v1, "hex"),
  );
}