facturaBoVerificarWebhook

Description

Checks the HMAC-SHA256 signature of a factura.bo webhook delivery (Webhook-Id, Webhook-Timestamp and Webhook-Signature headers, Standard Webhooks) and the message age (rejects over 5 min). Place it right after the Floogos Webhook trigger: it takes the headers and raw body by itself. If the signature is invalid the node errors. Use the event id to deduplicate.

Part of the Bolivia Fiscal Hub as an alternative to connecting directly to the SIAT: factura.bo (SimplifyIT S.R.L.) is a provider that builds and signs the XML and sends it to the SIN. Node: «Verificar firma de webhook».

Configuration

Field	Type	Required	Description
credentials_id	credentials	No	facturabo credential
webhook_secret	password	No	Webhook secret (optional) — Empty = the credential “webhook secret”
headers	json	No	Headers (JSON, optional) — Empty = those of the received request
raw_body	textarea	No	Raw body (optional) — Empty = the exact body of the received request. The signature is computed over the original bytes
tolerance_seconds	number	No	Age tolerance (s) — 0 = do not check the date
fail_on_invalid	boolean	No	Error if the signature is invalid
output_key	text	No	Output key — The result is added to data[key] keeping the rest of the data

Credentials

This module requires a credential of type facturabo with the fields:

API key: get it at app.factura.bo → More → API Key
Environment: testing (sandbox, pilot SIAT) or production; the key does not reveal it, you choose
NIT and SIAT system code: to sync CUIS/CUFD and catalogs
Default branch and point of sale: 0 = head office / main point
Webhook secret (whsec_…): to verify event signatures

Output

{
  "success": true,
  "valid": true,
  "reason": null,
  "event_id": "msg_9",
  "event_type": "factura.emitida",
  "timestamp_age_seconds": 2,
  "event": {
    "evento": "factura.emitida",
    "datos": {
      "cuf": "ABC"
    }
  },
  "warnings": []
}

The output is stored under the configured key (output_key, default facturabo) and the rest of data is kept. On error: error.message, error.type and, where applicable, status and siat_code.

Usage Example

{
  "credentials_id": "cred-facturabo",
  "fail_on_invalid": true
}

Notes

Verifies the standard signature (Standard Webhooks): Webhook-Id, Webhook-Timestamp (rejected if over 5 min old) and Webhook-Signature (v1, + base64 HMAC-SHA256 of id.timestamp.body, using the part of the secret after whsec_ base64-decoded). Makes no call.
Reads the headers and raw body from the trigger. If the raw body is unavailable it is rebuilt from the JSON and a warning is added: it may fail due to formatting differences.
Use event_id (Webhook-Id) to deduplicate: a delivery can arrive more than once.

facturaBoWebhooks - Gestionar webhooks