Webhooks

Content-Type: application/json
User-Agent: LineMeUp-Webhooks/1
LineMeUp-Signature: t=1767225600,v1=…
LineMeUp-Event-Id: evt-0193f2a1-7c4e-7a10-9b2e-000000000001
LineMeUp-Event-Type: visit.created
LineMeUp-Delivery-Id: whd-0193f2a1-7c4e-7a10-9b2e-000000000001

LineMeUp-Signature: t=1767225600,v1=<signed with the new secret>,v1=<signed with the old>

{
  "id": "evt-0193f2a1-7c4e-7a10-9b2e-000000000001",
  "type": "visit.created",
  "apiVersion": "v1",
  "createdAt": "2026-10-30T04:12:00.000Z",
  "businessId": "bus-0193f2a1-7c4e-7a10-9b2e-000000000001",
  "test": false,
  "data": {
    "visit": {
      "id": "job-0193f2a1-7c4e-7a10-9b2e-000000000001",
      "journeyId": "jny-0193f2a1-7c4e-7a10-9b2e-000000000001",
      "token": "GEN-20261030-014",
      "lineId": "line-0193f2a1-7c4e-7a10-9b2e-000000000001",
      "status": "queued",
      "bookingType": "walk_in",
      "priority": false,
      "customer": {
        "name": "Asha Rao",
        "phone": "+919000000001"
      },
      "services": [
        {
          "id": "svc-0193f2a1-7c4e-7a10-9b2e-000000000002",
          "name": "General consultation"
        }
      ],
      "deskId": null,
      "position": 3,
      "slotAt": null,
      "createdAt": "2026-10-30T04:12:00.000Z",
      "calledAt": null,
      "startedAt": null,
      "endedAt": null,
      "updatedAt": "2026-10-30T04:12:00.000Z"
    }
  }
}

{
  "id": "evt-0193f2a1-7c4e-7a10-9b2e-000000000001",
  "type": "visit.status_changed",
  "apiVersion": "v1",
  "createdAt": "2026-10-30T04:31:00.000Z",
  "businessId": "bus-0193f2a1-7c4e-7a10-9b2e-000000000001",
  "test": false,
  "data": {
    "visit": {
      "id": "job-0193f2a1-7c4e-7a10-9b2e-000000000001",
      "journeyId": "jny-0193f2a1-7c4e-7a10-9b2e-000000000001",
      "token": "GEN-20261030-014",
      "lineId": "line-0193f2a1-7c4e-7a10-9b2e-000000000001",
      "status": "called",
      "bookingType": "walk_in",
      "priority": false,
      "customer": {
        "name": "Asha Rao",
        "phone": "+919000000001"
      },
      "services": [
        {
          "id": "svc-0193f2a1-7c4e-7a10-9b2e-000000000002",
          "name": "General consultation"
        }
      ],
      "deskId": "sta-0193f2a1-7c4e-7a10-9b2e-000000000001",
      "position": null,
      "slotAt": null,
      "createdAt": "2026-10-30T04:12:00.000Z",
      "calledAt": "2026-10-30T04:31:00.000Z",
      "startedAt": null,
      "endedAt": null,
      "updatedAt": "2026-10-30T04:31:00.000Z"
    },
    "from": "queued",
    "to": "called"
  }
}

{
  "id": "evt-0193f2a1-7c4e-7a10-9b2e-000000000001",
  "type": "visit.updated",
  "apiVersion": "v1",
  "createdAt": "2026-10-30T04:15:00.000Z",
  "businessId": "bus-0193f2a1-7c4e-7a10-9b2e-000000000001",
  "test": false,
  "data": {
    "visit": {
      "id": "job-0193f2a1-7c4e-7a10-9b2e-000000000001",
      "journeyId": "jny-0193f2a1-7c4e-7a10-9b2e-000000000001",
      "token": "GEN-20261030-014",
      "lineId": "line-0193f2a1-7c4e-7a10-9b2e-000000000001",
      "status": "queued",
      "bookingType": "walk_in",
      "priority": true,
      "customer": {
        "name": "Asha Rao",
        "phone": "+919000000001"
      },
      "services": [
        {
          "id": "svc-0193f2a1-7c4e-7a10-9b2e-000000000002",
          "name": "General consultation"
        }
      ],
      "deskId": null,
      "position": 1,
      "slotAt": null,
      "createdAt": "2026-10-30T04:12:00.000Z",
      "calledAt": null,
      "startedAt": null,
      "endedAt": null,
      "updatedAt": "2026-10-30T04:15:00.000Z"
    },
    "changed": [
      "priority"
    ]
  }
}

{
  "id": "evt-0193f2a1-7c4e-7a10-9b2e-000000000001",
  "type": "line.paused",
  "apiVersion": "v1",
  "createdAt": "2026-10-30T06:30:00.000Z",
  "businessId": "bus-0193f2a1-7c4e-7a10-9b2e-000000000001",
  "test": false,
  "data": {
    "line": {
      "id": "line-0193f2a1-7c4e-7a10-9b2e-000000000001",
      "name": "General",
      "code": "GEN",
      "type": "walk_in",
      "paused": true,
      "waiting": 4,
      "avgServiceMinutes": 10,
      "maxCapacity": 60,
      "description": "Walk-ins for a first visit",
      "location": "Ground floor",
      "callGraceMinutes": 5,
      "appointmentGraceBeforeMinutes": 10,
      "maxLateArrivalMinutes": 15,
      "autoNoShowEnabled": true
    }
  }
}

{
  "id": "evt-0193f2a1-7c4e-7a10-9b2e-000000000001",
  "type": "line.resumed",
  "apiVersion": "v1",
  "createdAt": "2026-10-30T07:00:00.000Z",
  "businessId": "bus-0193f2a1-7c4e-7a10-9b2e-000000000001",
  "test": false,
  "data": {
    "line": {
      "id": "line-0193f2a1-7c4e-7a10-9b2e-000000000001",
      "name": "General",
      "code": "GEN",
      "type": "walk_in",
      "paused": false,
      "waiting": 4,
      "avgServiceMinutes": 10,
      "maxCapacity": 60,
      "description": "Walk-ins for a first visit",
      "location": "Ground floor",
      "callGraceMinutes": 5,
      "appointmentGraceBeforeMinutes": 10,
      "maxLateArrivalMinutes": 15,
      "autoNoShowEnabled": true
    }
  }
}

{
  "id": "evt-0193f2a1-7c4e-7a10-9b2e-000000000001",
  "type": "desk.status_changed",
  "apiVersion": "v1",
  "createdAt": "2026-10-30T06:30:00.000Z",
  "businessId": "bus-0193f2a1-7c4e-7a10-9b2e-000000000001",
  "test": false,
  "data": {
    "desk": {
      "id": "sta-0193f2a1-7c4e-7a10-9b2e-000000000001",
      "name": "Dr Mehta",
      "type": "person",
      "publicLabel": "Room 1",
      "active": true,
      "state": "break",
      "lineIds": [
        "line-0193f2a1-7c4e-7a10-9b2e-000000000001"
      ]
    },
    "from": "available",
    "to": "break"
  }
}

{
  "id": "evt-0193f2a1-7c4e-7a10-9b2e-000000000001",
  "type": "webhook.test",
  "apiVersion": "v1",
  "createdAt": "2026-10-30T05:00:00.000Z",
  "businessId": "bus-0193f2a1-7c4e-7a10-9b2e-000000000001",
  "test": true,
  "data": {
    "message": "A test event from Line Me Up. Your endpoint is receiving webhooks."
  }
}

LineMeUp-Signature: t=1767225600,v1=8121c9169bb7f71dc187cf9f286d6774f09debfa91503a20359a2e875c99e65b

signed = t + "." + rawBody
v1     = hex( HMAC-SHA256( key = secret, message = signed ) )

200 OK            ← answer first, within 10 seconds
… then do the work, from your own queue

// verify-line-me-up.mjs — Node 18 or later, no dependencies.
import { createHmac, timingSafeEqual } from "node:crypto";

/**
 * Whether a delivery really came from Line Me Up.
 *
 * rawBody: the request body exactly as it arrived (a Buffer or a string) —
 *          never JSON you parsed and turned back into text.
 * header:  the LineMeUp-Signature header.
 * secret:  your endpoint's signing secret, whsec_…
 */
export function verifyLineMeUp(
  rawBody,
  header,
  secret,
  { toleranceSeconds = 300, nowSeconds = Math.floor(Date.now() / 1000) } = {},
) {
  if (typeof header !== "string" || typeof secret !== "string") return false;
  const parts = header.split(",").map((part) => part.trim());
  const t = parts.find((part) => part.startsWith("t="))?.slice(2);
  if (t === undefined || !/^\d+$/.test(t)) return false;
  if (Math.abs(nowSeconds - Number(t)) > toleranceSeconds) return false;

  const expected = createHmac("sha256", secret).update(`${t}.`).update(rawBody).digest();
  return parts
    .filter((part) => part.startsWith("v1="))
    .some((part) => {
      const given = Buffer.from(part.slice(3), "hex");
      return given.length === expected.length && timingSafeEqual(given, expected);
    });
}

// server.mjs — npm install express
import express from "express";
import { verifyLineMeUp } from "./verify-line-me-up.mjs";

const app = express();

// express.raw, not express.json: the signature is over the bytes as sent.
app.post("/webhooks/line-me-up", express.raw({ type: "application/json" }), (req, res) => {
  const ok = verifyLineMeUp(
    req.body,
    req.get("LineMeUp-Signature"),
    process.env.LINEMEUP_WEBHOOK_SECRET,
  );
  if (!ok) return res.status(400).send("Bad signature");

  const event = JSON.parse(req.body.toString("utf8"));
  res.sendStatus(200); // answer within 10 seconds, then do the work
  queueForProcessing(event); // your own queue; dedupe on event.id
});

app.listen(3000);

# verify_line_me_up.py — Python 3.8 or later, standard library only.
import hashlib
import hmac
import time


def verify_line_me_up(raw_body, header, secret, tolerance=300, now=None):
    """Whether a delivery really came from Line Me Up.

    raw_body: the request body as bytes, exactly as it arrived.
    header:   the LineMeUp-Signature header.
    secret:   your endpoint's signing secret, whsec_...
    """
    if not header or not secret:
        return False
    parts = [part.strip() for part in header.split(",")]
    t = next((part[2:] for part in parts if part.startswith("t=")), None)
    if t is None or not t.isdigit():
        return False
    now = int(time.time()) if now is None else now
    if abs(now - int(t)) > tolerance:
        return False

    signed = t.encode("ascii") + b"." + raw_body
    expected = hmac.new(secret.encode("utf-8"), signed, hashlib.sha256).hexdigest()
    return any(
        hmac.compare_digest(part[3:], expected) for part in parts if part.startswith("v1=")
    )


# Flask — pip install flask
import json
import os

from flask import Flask, request

app = Flask(__name__)


@app.post("/webhooks/line-me-up")
def line_me_up():
    raw_body = request.get_data()  # the bytes, before any parsing
    header = request.headers.get("LineMeUp-Signature", "")
    if not verify_line_me_up(raw_body, header, os.environ["LINEMEUP_WEBHOOK_SECRET"]):
        return "Bad signature", 400
    event = json.loads(raw_body)
    queue_for_processing(event)  # your own queue; dedupe on event["id"]
    return "", 200

<?php
// verify_line_me_up.php — PHP 8.0 or later, no extensions beyond the defaults.

/**
 * Whether a delivery really came from Line Me Up.
 *
 * $rawBody: the request body exactly as it arrived (php://input).
 * $header:  the LineMeUp-Signature header.
 * $secret:  your endpoint's signing secret, whsec_…
 */
function verify_line_me_up(
    string $rawBody,
    string $header,
    string $secret,
    int $tolerance = 300,
    ?int $now = null
): bool {
    $t = null;
    $signatures = [];
    foreach (explode(',', $header) as $part) {
        $part = trim($part);
        if (str_starts_with($part, 't=')) {
            $t = substr($part, 2);
        } elseif (str_starts_with($part, 'v1=')) {
            $signatures[] = substr($part, 3);
        }
    }
    if ($t === null || !ctype_digit($t)) {
        return false;
    }
    $now = $now ?? time();
    if (abs($now - (int) $t) > $tolerance) {
        return false;
    }

    $expected = hash_hmac('sha256', $t . '.' . $rawBody, $secret);
    foreach ($signatures as $signature) {
        if (hash_equals($expected, $signature)) {
            return true;
        }
    }
    return false;
}

// Receiving:
$rawBody = file_get_contents('php://input');
$header = $_SERVER['HTTP_LINEMEUP_SIGNATURE'] ?? '';
if (!verify_line_me_up($rawBody, $header, getenv('LINEMEUP_WEBHOOK_SECRET'))) {
    http_response_code(400);
    exit('Bad signature');
}
$event = json_decode($rawBody, true);
http_response_code(200);
// Queue $event for processing after answering; dedupe on $event['id'].

// main.go — Go 1.20 or later, standard library only.
package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"io"
	"net/http"
	"os"
	"strconv"
	"strings"
	"time"
)

// VerifyLineMeUp reports whether a delivery really came from Line Me Up.
// rawBody must be the request body exactly as it arrived; header is
// LineMeUp-Signature; secret is your endpoint's signing secret, whsec_….
func VerifyLineMeUp(rawBody []byte, header, secret string, tolerance time.Duration, now time.Time) bool {
	var t string
	var signatures []string
	for _, part := range strings.Split(header, ",") {
		part = strings.TrimSpace(part)
		switch {
		case strings.HasPrefix(part, "t="):
			t = part[2:]
		case strings.HasPrefix(part, "v1="):
			signatures = append(signatures, part[3:])
		}
	}
	if t == "" || strings.Trim(t, "0123456789") != "" {
		return false
	}
	ts, err := strconv.ParseInt(t, 10, 64)
	if err != nil {
		return false
	}
	age := now.Unix() - ts
	if age < 0 {
		age = -age
	}
	if age > int64(tolerance/time.Second) {
		return false
	}

	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(t + "."))
	mac.Write(rawBody)
	expected := mac.Sum(nil)
	for _, s := range signatures {
		given, err := hex.DecodeString(s)
		if err == nil && hmac.Equal(given, expected) {
			return true
		}
	}
	return false
}

func lineMeUp(w http.ResponseWriter, r *http.Request) {
	rawBody, err := io.ReadAll(io.LimitReader(r.Body, 1<<20))
	if err != nil {
		http.Error(w, "Unreadable body", http.StatusBadRequest)
		return
	}
	header := r.Header.Get("LineMeUp-Signature")
	if !VerifyLineMeUp(rawBody, header, os.Getenv("LINEMEUP_WEBHOOK_SECRET"), 5*time.Minute, time.Now()) {
		http.Error(w, "Bad signature", http.StatusBadRequest)
		return
	}
	var event struct {
		ID   string          `json:"id"`
		Type string          `json:"type"`
		Data json.RawMessage `json:"data"`
	}
	if err := json.Unmarshal(rawBody, &event); err != nil {
		http.Error(w, "Not JSON", http.StatusBadRequest)
		return
	}
	w.WriteHeader(http.StatusOK)
	// Queue event for processing after answering; dedupe on event.ID.
}

func main() {
	http.HandleFunc("/webhooks/line-me-up", lineMeUp)
	_ = http.ListenAndServe(":3000", nil)
}

[
  {
    "name": "One secret",
    "secret": "whsec_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "body": "{\"id\":\"evt-test\",\"type\":\"webhook.test\"}",
    "header": "t=1767225600,v1=8121c9169bb7f71dc187cf9f286d6774f09debfa91503a20359a2e875c99e65b",
    "now": 1767225600,
    "valid": true
  },
  {
    "name": "Another secret, same body and time",
    "secret": "whsec_bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
    "body": "{\"id\":\"evt-test\",\"type\":\"webhook.test\"}",
    "header": "t=1767225600,v1=d1c064106654840a74d3c50811840a5e784a4d71e8aefe9ea6833db05fde1aa1",
    "now": 1767225600,
    "valid": true
  },
  {
    "name": "During Roll secret: two signatures, checked with the new secret",
    "secret": "whsec_bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
    "body": "{\"id\":\"evt-test\",\"type\":\"webhook.test\"}",
    "header": "t=1767225600,v1=d1c064106654840a74d3c50811840a5e784a4d71e8aefe9ea6833db05fde1aa1,v1=8121c9169bb7f71dc187cf9f286d6774f09debfa91503a20359a2e875c99e65b",
    "now": 1767225600,
    "valid": true
  },
  {
    "name": "During Roll secret: two signatures, checked with the old secret",
    "secret": "whsec_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "body": "{\"id\":\"evt-test\",\"type\":\"webhook.test\"}",
    "header": "t=1767225600,v1=d1c064106654840a74d3c50811840a5e784a4d71e8aefe9ea6833db05fde1aa1,v1=8121c9169bb7f71dc187cf9f286d6774f09debfa91503a20359a2e875c99e65b",
    "now": 1767225600,
    "valid": true
  },
  {
    "name": "An empty body at t=0 — the signed text is just “0.”",
    "secret": "whsec_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "body": "",
    "header": "t=0,v1=20a6f56986af223065295efdd6923ab05c052a1ac3931f3d10a9dca70749f44b",
    "now": 0,
    "valid": true
  },
  {
    "name": "Four minutes late — still inside the five-minute tolerance",
    "secret": "whsec_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "body": "{\"id\":\"evt-test\",\"type\":\"webhook.test\"}",
    "header": "t=1767225600,v1=8121c9169bb7f71dc187cf9f286d6774f09debfa91503a20359a2e875c99e65b",
    "now": 1767225840,
    "valid": true
  },
  {
    "name": "The body changed by one space",
    "secret": "whsec_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "body": "{\"id\":\"evt-test\",\"type\":\"webhook.test\"} ",
    "header": "t=1767225600,v1=8121c9169bb7f71dc187cf9f286d6774f09debfa91503a20359a2e875c99e65b",
    "now": 1767225600,
    "valid": false
  },
  {
    "name": "The wrong secret",
    "secret": "whsec_ccccccccccccccccccccccccccccccccccccccccccc",
    "body": "{\"id\":\"evt-test\",\"type\":\"webhook.test\"}",
    "header": "t=1767225600,v1=8121c9169bb7f71dc187cf9f286d6774f09debfa91503a20359a2e875c99e65b",
    "now": 1767225600,
    "valid": false
  },
  {
    "name": "Too old — five minutes and one second",
    "secret": "whsec_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "body": "{\"id\":\"evt-test\",\"type\":\"webhook.test\"}",
    "header": "t=1767225600,v1=8121c9169bb7f71dc187cf9f286d6774f09debfa91503a20359a2e875c99e65b",
    "now": 1767225901,
    "valid": false
  },
  {
    "name": "No t= in the header",
    "secret": "whsec_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "body": "{\"id\":\"evt-test\",\"type\":\"webhook.test\"}",
    "header": "v1=8121c9169bb7f71dc187cf9f286d6774f09debfa91503a20359a2e875c99e65b",
    "now": 1767225600,
    "valid": false
  }
]

{
  "id": "evt-0193f2a1-7c4e-7a10-9b2e-000000000001",
  "type": "webhook.test",
  "apiVersion": "v1",
  "createdAt": "2026-10-30T05:00:00.000Z",
  "businessId": "bus-0193f2a1-7c4e-7a10-9b2e-000000000001",
  "test": true,
  "data": {
    "message": "A test event from Line Me Up. Your endpoint is receiving webhooks."
  }
}