API Reference

GET /api/v1/me
Authorization: Bearer at_live_…

POST /api/outbound-webhooks/:restaurantId/endpoints
Authorization: Bearer <session token, or platform API key>
x-csrf-token: <double-submit cookie>
Content-Type: application/json

{
  "url": "https://api.acme.com/hooks/attable",
  "description": "Finance system (prod)",
  "events": ["order.settled"]
}

POST /api/orgs/:orgId/webhooks
Authorization: Bearer <session token, or platform API key>
x-csrf-token: <double-submit cookie>
Content-Type: application/json

{
  "url": "https://api.acme.com/hooks/attable",
  "description": "Group finance sync (prod)",
  "events": ["order.settled", "org.verification_approved"]
}

{
  "id": "5c2f…",                        // event id (idempotency key)
  "type": "order.settled",              // event type
  "organisationId": "9f7…" | null,      // the group, when the venue is in one
  "restaurantId": "3ab…" | null,        // the venue — always set on venue events
  "createdAt": "2026-05-14T09:12:33Z",  // ISO 8601 UTC
  "data": { … }                         // event-specific body
}

import express from 'express';
import crypto from 'node:crypto';

const app = express();

app.post('/hooks/attable', express.raw({ type: 'application/json' }), (req, res) => {
  const sigHeader = req.header('AtTable-Signature') ?? '';
  const parts = Object.fromEntries(
    sigHeader.split(',').map((kv) => kv.split('=') as [string, string])
  );
  const t = Number(parts.t);
  const v1 = parts.v1;
  if (!t || !v1) return res.status(400).send('bad signature');

  // Reject events older than 5 minutes to defeat replays.
  if (Math.abs(Date.now() / 1000 - t) > 300) {
    return res.status(400).send('stale');
  }

  const expected = crypto
    .createHmac('sha256', process.env.ATTABLE_WEBHOOK_SECRET!)
    .update(`${t}.${req.body.toString('utf8')}`)
    .digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1))) {
    return res.status(401).send('bad sig');
  }

  const event = JSON.parse(req.body.toString('utf8'));
  // … handle event …
  return res.status(200).send('ok');
});

import hmac, hashlib, os, time
from fastapi import FastAPI, Header, HTTPException, Request

app = FastAPI()

@app.post("/hooks/attable")
async def attable_hook(
    request: Request,
    attable_signature: str = Header(...),
):
    parts = dict(p.split("=", 1) for p in attable_signature.split(","))
    t, v1 = int(parts["t"]), parts["v1"]
    if abs(time.time() - t) > 300:
        raise HTTPException(400, "stale")

    raw = await request.body()
    expected = hmac.new(
        os.environ["ATTABLE_WEBHOOK_SECRET"].encode(),
        f"{t}.{raw.decode()}".encode(),
        hashlib.sha256,
    ).hexdigest()
    if not hmac.compare_digest(expected, v1):
        raise HTTPException(401, "bad sig")

    event = await request.json()
    # … handle event …
    return {"ok": True}

require 'sinatra'
require 'openssl'
require 'json'

post '/hooks/attable' do
  sig = request.env['HTTP_ATTABLE_SIGNATURE'] || ''
  parts = sig.split(',').to_h { |kv| kv.split('=', 2) }
  t = parts['t'].to_i
  v1 = parts['v1']
  halt 400, 'stale' if (Time.now.to_i - t).abs > 300

  body = request.body.read
  expected = OpenSSL::HMAC.hexdigest(
    'SHA256', ENV['ATTABLE_WEBHOOK_SECRET'], "#{t}.#{body}"
  )
  halt 401, 'bad sig' unless Rack::Utils.secure_compare(expected, v1)

  event = JSON.parse(body)
  # … handle event …
  status 200
end

async function handleApproved(event: VerificationApprovedEvent) {
  const { organisationId, data } = event;

  // 1. Find or create the customer in your billing tool.
  const customer = await ourBilling.customers.upsert({
    externalId: organisationId,
    name: data.legalName,
    country: data.countryCode,
    status: 'active',
  });

  // 2. Provision the entitlements your product gates on.
  await entitlements.grant(customer.id, ['production-api', 'high-volume-tier']);

  // 3. Notify the AM in Slack.
  await slack.send(
    '#sales',
    `:white_check_mark: ${data.legalName} approved — provisioned in billing.`
  );
}

async function handleRejected(event: VerificationRejectedEvent) {
  const { organisationId, data } = event;

  await salesforce.records.update('Account', {
    AtTableOrgId__c: organisationId,
    KYB_Status__c: 'Rejected',
    KYB_Rejection_Reason__c: data.reason,
    KYB_Reviewed_At__c: data.reviewedAt,
  });

  await salesforce.tasks.create({
    Subject: `KYB rejected — follow up with ${data.legalName}`,
    Description: data.reason,
    WhatId: 'AtTableOrgId__c=' + organisationId,
    OwnerId: '$lookup:AccountManager',
    Priority: 'High',
  });
}

const handlers: Record<string, (e: AtTableEvent) => Promise<void>> = {
  'org.verification_approved': handleApproved,
  'org.verification_rejected': handleRejected,
  'webhook.test': async () => { /* no-op, just 200 */ },
};

app.post('/hooks/attable', verifySignature, async (req, res) => {
  const event = JSON.parse(req.body.toString('utf8')) as AtTableEvent;

  // De-dupe — same delivery id may arrive twice if our ack was lost.
  if (await seenEvents.has(event.id)) return res.status(200).send('dup');
  await seenEvents.add(event.id, { ttlSeconds: 24 * 60 * 60 });

  const handler = handlers[event.type];
  if (handler) await handler(event);
  return res.status(200).send('ok');
});

Header              Format
─────────────────────────────────────────────────────────────────
AtTable-Event       <event-type>
AtTable-Event-Id    <delivery-id>            # idempotency key
AtTable-Signature   t=<unix>,v1=<hex-hmac>   # HMAC over "<t>.<raw-body>"

Body                {
                      id, type, organisationId, restaurantId,
                      createdAt, data
                    }

Signing             HMAC_SHA256(secret, "<t>.<raw-body>") → hex
Tolerance           ±5 minutes
Ack window          5 seconds
Success             any 2xx
Delivery            at-least-once — dedupe on AtTable-Event-Id
Retries             6 attempts, exponential backoff from 10s
Retried on          network error, timeout, 5xx, 408, 429
Auto-disable        20 consecutive failures