curl -X POST https://api.fiscalflowsupport.com/api/v1/webhooks \
  -H "X-API-Key: ffs_live_ejemplodeclavenoreal000000000000000000" \
  -H "Content-Type: application/json" \
  -d '{
    "company_uuid": "b3f1c0a2-5d47-4e91-8c26-0af3d9e17b45",
    "name": "ERP producción",
    "url": "https://erp.ejemplo.com/hooks/fiscalflow",
    "events": ["document.emission.completed", "document.reception.received"]
  }'

{
  "success": true,
  "message": "Webhook created. Save the secret - it will not be shown again.",
  "data": {
    "uuid": "6d2a9b71-3e84-4c5f-9a02-7b1c8d4e6f30",
    "company_uuid": "b3f1c0a2-5d47-4e91-8c26-0af3d9e17b45",
    "name": "ERP producción",
    "url": "https://erp.ejemplo.com/hooks/fiscalflow",
    "events": ["document.emission.completed", "document.reception.received"],
    "is_active": true,
    "secret": "3f9c1d7a5e2b804613cf8a2d90e47b5c16ad38f2049e7c6b1d5a8309f42e6b7c"
  }
}

{
  "event": "document.emission.completed",
  "document_id": 4821,
  "type": "31",
  "encf": "E310000000001",
  "status": "accepted",
  "track_id": "4A8F2C1E9B",
  "amount": 5900.00,
  "currency": "DOP",
  "buyer_rnc": "101000001",
  "environment": "ecf",
  "qr_url": "https://api.fiscalflowsupport.com/api/v1/documents/01JZ8K4QM2N5P7R9T1V3W5X7Y9/qr",
  "error_message": null,
  "accepted_at": "2026-08-14T15:06:02+00:00",
  "timestamp": "2026-08-14T15:06:02+00:00"
}

import hmac, hashlib
from flask import Flask, request, abort

SECRET = "3f9c1d7a5e2b804613cf8a2d90e47b5c16ad38f2049e7c6b1d5a8309f42e6b7c"

app = Flask(__name__)

@app.post("/hooks/fiscalflow")
def fiscalflow():
    raw = request.get_data()  # bytes crudos, sin parsear
    expected = "sha256=" + hmac.new(
        SECRET.encode(), raw, hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, request.headers.get("X-FFS-Signature", "")):
        abort(401)

    event = request.get_json()
    if event["event"] == "document.emission.completed":
        marcar_documento(event["encf"], event["status"], event.get("error_message"))

    return "", 200

<?php

$secret = '3f9c1d7a5e2b804613cf8a2d90e47b5c16ad38f2049e7c6b1d5a8309f42e6b7c';

$raw = file_get_contents('php://input');           // cuerpo crudo
$expected = 'sha256='.hash_hmac('sha256', $raw, $secret);
$received = $_SERVER['HTTP_X_FFS_SIGNATURE'] ?? '';

if (! hash_equals($expected, $received)) {
    http_response_code(401);
    exit;
}

$event = json_decode($raw, true);

if ($event['event'] === 'document.emission.completed') {
    marcarDocumento($event['encf'], $event['status'], $event['error_message'] ?? null);
}

http_response_code(200);

import crypto from "node:crypto";
import express from "express";

const SECRET = "3f9c1d7a5e2b804613cf8a2d90e47b5c16ad38f2049e7c6b1d5a8309f42e6b7c";
const app = express();

// express.raw, no express.json: hay que firmar sobre los bytes originales
app.post("/hooks/fiscalflow", express.raw({ type: "application/json" }), (req, res) => {
  const expected =
    "sha256=" + crypto.createHmac("sha256", SECRET).update(req.body).digest("hex");
  const received = req.get("X-FFS-Signature") ?? "";

  if (
    expected.length !== received.length ||
    !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received))
  ) {
    return res.sendStatus(401);
  }

  const event = JSON.parse(req.body.toString());
  if (event.event === "document.emission.completed") {
    marcarDocumento(event.encf, event.status, event.error_message);
  }

  res.sendStatus(200);
});

curl -H "X-API-Key: ffs_live_ejemplodeclavenoreal000000000000000000" \
  https://api.fiscalflowsupport.com/api/v1/webhooks/6d2a9b71-3e84-4c5f-9a02-7b1c8d4e6f30/deliveries