Stock Webhook API

{
  "event": "vehicle.upsert",
  "schema_version": 1,
  "delivery_id": "6f1c2e0a-8b47-4c1d-9a35-2f7d1e4b6c90",
  "sent_at": "2026-11-05T09:12:33Z",
  "dealer": {
    "id": "DG-00-0000",
    "name": "Example Motors",
    "phone": "01234 567890",
    "email": "sales@example-motors.co.uk",
    "website": "https://www.example-motors.co.uk",
    "address_line_1": "1 High Street",
    "town": "Luton",
    "postcode": "LU1 1AA"
  },
  "vehicle": {
    "id": "a3e9b7d2-41f6-4c08-b1de-7c5a90e2f314",
    "registration": "AB73CDE",
    "status": "in_stock",
    "vehicle_type": "Car",
    "make": "Vauxhall",
    "model": "Corsa",
    "generation": "Hatchback (2019 onwards)",
    "derivative": "1.2 Turbo Design 5dr",
    "trim": "Design",
    "body_type": "Hatchback",
    "fuel_type": "Petrol",
    "transmission": "Manual",
    "drivetrain": "Front Wheel Drive",
    "colour": "Blue",
    "doors": 5,
    "seats": 5,
    "year": 2024,
    "first_registered": "2024-01-18",
    "mileage": 34515,
    "owners": 1,
    "engine_size_cc": 1199,
    "power_bhp": 99,
    "co2_g_km": 118,
    "emission_class": "Euro 6",
    "mpg_combined": 53.3,
    "insurance_group": "12E",
    "mot_expiry": "2027-01-17",
    "service_history": "Full dealership history",
    "price": 10294,
    "price_on_application": false,
    "vat_status": "No VAT",
    "attention_grabber": "ONE OWNER, FULL HISTORY",
    "description": "A one owner Corsa with full dealership service history.",
    "features": ["Apple CarPlay", "Parking sensors", "Heated seats"],
    "images": [
      "https://images.example.com/ab73cde/1.jpg",
      "https://images.example.com/ab73cde/2.jpg"
    ],
    "videos": [],
    "updated_at": "2026-11-05T09:08:02Z"
  }
}

{
  "event": "vehicle.removed",
  "schema_version": 1,
  "delivery_id": "0d4b8a31-7e52-4f6a-8c19-5be2a7f3c021",
  "sent_at": "2026-11-05T15:40:07Z",
  "dealer": {
    "id": "DG-00-0000",
    "name": "Example Motors"
  },
  "vehicle": {
    "id": "a3e9b7d2-41f6-4c08-b1de-7c5a90e2f314",
    "registration": "AB73CDE",
    "reason": "sold"
  }
}

{
  "event": "test.ping",
  "schema_version": 1,
  "delivery_id": "c27e9f14-3a68-4b0d-a5e1-91d4f06b7e38",
  "sent_at": "2026-11-05T09:00:00Z",
  "dealer": {
    "id": "DG-00-0000",
    "name": "Example Motors"
  }
}

const crypto = require('crypto');
const express = require('express');

const app = express();
const secret = process.env.DEALERGATE_SECRET;

// express.raw keeps the exact bytes we sent, which is what the signature covers.
app.post('/dealergate', express.raw({ type: 'application/json' }), (req, res) => {
  const timestamp = req.get('X-DealerGate-Timestamp') || '';
  const signature = req.get('X-DealerGate-Signature') || '';

  const expected = 'sha256=' + crypto.createHmac('sha256', secret)
    .update(timestamp + '.')
    .update(req.body)
    .digest('hex');

  const recent = Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;
  const matches = signature.length === expected.length
    && crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
  if (!recent || !matches) return res.sendStatus(401);

  const delivery = JSON.parse(req.body);
  // Save the delivery here, then answer. Do slow work afterwards.
  res.sendStatus(200);
});

app.listen(process.env.PORT || 3000);

<?php
$secret = getenv('DEALERGATE_SECRET');

// Read the exact bytes we sent, which is what the signature covers.
$body = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_DEALERGATE_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_DEALERGATE_SIGNATURE'] ?? '';

$expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $body, $secret);

$recent = ctype_digit($timestamp) && abs(time() - (int) $timestamp) <= 300;
if (!$recent || !hash_equals($expected, $signature)) {
    http_response_code(401);
    exit;
}

$delivery = json_decode($body, true);
// Save the delivery here, then answer. Do slow work afterwards.
http_response_code(200);

import hashlib
import hmac
import os
import time

from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ['DEALERGATE_SECRET'].encode()


@app.post('/dealergate')
def dealergate():
    timestamp = request.headers.get('X-DealerGate-Timestamp', '')
    signature = request.headers.get('X-DealerGate-Signature', '')

    # get_data() returns the exact bytes we sent, which is what the signature covers.
    signed = timestamp.encode() + b'.' + request.get_data()
    expected = 'sha256=' + hmac.new(SECRET, signed, hashlib.sha256).hexdigest()

    recent = timestamp.isdigit() and abs(time.time() - int(timestamp)) <= 300
    if not recent or not hmac.compare_digest(expected, signature):
        abort(401)

    delivery = request.get_json()
    # Save the delivery here, then answer. Do slow work afterwards.
    return '', 200