{
  "type": "post_call_transcription",
  "event_timestamp": 1739537297,
  "data": {
    "agent_id": "agent_abc123",
    "conversation_id": "conv_xyz789",
    "transcript": [
      {
        "role": "agent",
        "message": "Hallo, vielen Dank für Ihren Anruf. Wie kann ich Ihnen helfen?",
        "time_in_call_secs": 0
      },
      {
        "role": "user",
        "message": "Ich möchte einen Termin vereinbaren.",
        "time_in_call_secs": 3
      },
      {
        "role": "agent",
        "message": "Gerne! Für wann hätten Sie es denn gerne?",
        "time_in_call_secs": 5
      }
    ],
    "metadata": {
      "start_time_unix_secs": 1739537200,
      "call_duration_secs": 45
    },
    "analysis": {
      "call_successful": "true",
      "transcript_summary": "Der Anrufer hat einen Termin für Freitag um 14 Uhr vereinbart.",
      "evaluation_criteria_results": {},
      "data_collection_results": {}
    },
    "conversation_initiation_client_data": {
      "dynamic_variables": {
        "caller_name": "Max Mustermann",
        "caller_number": "+4917612345678"
      }
    }
  },
  "voisa": {
    "forwarded_at": "2026-03-04T15:30:00.000Z",
    "agent_name": "Praxis Dr. Müller"
  }
}

X-Voisa-Signature: t=1709537300,v0=5a2f...c3e1

HMAC-SHA256(secret, "<timestamp>.<json-body>")

const crypto = require('crypto');

function verifyWebhook(req, secret) {
  const signature = req.headers['x-voisa-signature'];
  if (!signature) return false;

  // Header parsen
  const parts = {};
  signature.split(',').forEach(part => {
    const [key, value] = part.split('=');
    parts[key] = value;
  });

  const timestamp = parts['t'];
  const receivedHmac = parts['v0'];

  // Eigene Signatur berechnen
  const body = JSON.stringify(req.body); // oder raw body als String
  const hmac = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${body}`)
    .digest('hex');

  // Vergleichen (timing-safe)
  return crypto.timingSafeEqual(
    Buffer.from(hmac, 'hex'),
    Buffer.from(receivedHmac, 'hex')
  );
}

import hmac
import hashlib

def verify_webhook(headers, body, secret):
    signature = headers.get('X-Voisa-Signature', '')
    if not signature:
        return False

    parts = dict(p.split('=', 1) for p in signature.split(','))
    timestamp = parts.get('t', '')
    received_hmac = parts.get('v0', '')

    expected = hmac.new(
        secret.encode(),
        f"{timestamp}.{body}".encode(),
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(expected, received_hmac)