Kom i gang med Forta Pay API'et

# Sæt din sandbox-nøgle (fp_test_…) / set your sandbox key (fp_test_…)
export FP_API=${FP_API:-https://api.fortapay.dk/v1}
export FP_KEY=${FP_KEY:?FP_KEY: din/your fp_test_ key}

# fp METODE STI [KROP]  — et kald med nøgle og Idempotency-Key; stopper ved 4xx/5xx og viser fejlen
fp() {
  local metode=$1 sti=$2; shift 2
  local h=(-H "Authorization: Bearer $FP_KEY" -H "Accept: application/json")
  if [ "$metode" != GET ]; then h+=(-H "Idempotency-Key: ${IDEM:-$(uuidgen)}"); fi
  if [ $# -gt 0 ]; then h+=(-H "Content-Type: application/json" --data-binary "$1"); fi
  curl -sS --fail-with-body -X "$metode" "${h[@]}" "$FP_API$sti"
}

fp GET /account | jq -c '{id, environment}'

CREDITOR_ID=$(fp GET /creditors | jq -r '.data[0].id')
RUN=$(date +%s)                                   # gør external_ref unik pr. kørsel / unique per run
NOW=$(fp GET /sandbox/clock | jq -r .now)          # sandbox-urets tid / the sandbox clock
TODAY=$(fp GET /sandbox/clock | jq -r .today)
DUE=$(jq -rn --arg d "$TODAY" '$d + "T00:00:00Z" | fromdate + 14*86400 | strftime("%Y-%m-%d")')
echo "{\"creditor\": \"$CREDITOR_ID\", \"today\": \"$TODAY\", \"due\": \"$DUE\"}"

KEY=$(uuidgen)
A=$(IDEM=$KEY fp POST /debtors @- <<JSON | jq -r .id
{"creditor_id": "$CREDITOR_ID", "name": "Idempotens ApS", "type": "business", "external_ref": "idem-$RUN"}
JSON
)
B=$(IDEM=$KEY fp POST /debtors @- <<JSON | jq -r .id
{"creditor_id": "$CREDITOR_ID", "name": "Idempotens ApS", "type": "business", "external_ref": "idem-$RUN"}
JSON
)
echo "{\"same_id\": $([ "$A" = "$B" ] && echo true || echo false)}"

# Samme nøgle, anden krop → 422 idempotency_key_reused. curl stopper; vi viser fejlen og går videre.
# Same key, different body → 422 idempotency_key_reused. curl fails; we print the problem and continue.
IDEM=$KEY fp POST /debtors @- <<JSON || true
{"creditor_id": "$CREDITOR_ID", "name": "Et andet navn", "type": "business", "external_ref": "idem-$RUN"}
JSON
echo
fp GET /invoices/inv_FINDESIKKE | jq -c '{status, code}' || true

CURSOR=""
while :; do
  SIDE=$(fp GET "/invoices?creditor_id=$CREDITOR_ID&limit=2${CURSOR:+&cursor=$CURSOR}")
  jq -r '.data[] | [.id, .status, .balance.amount] | @tsv' <<<"$SIDE"
  [ "$(jq -r .has_more <<<"$SIDE")" = true ] || break
  CURSOR=$(jq -r .next_cursor <<<"$SIDE")
done
echo '{"done": true}'

DEBTOR_ID=$(fp POST /debtors @- <<JSON | jq -r .id
{"creditor_id": "$CREDITOR_ID", "name": "Jens Hansen", "type": "person",
 "email": "jens.hansen@example.com", "external_ref": "kunde-$RUN"}
JSON
)
echo "{\"debtor_id\": \"$DEBTOR_ID\"}"

INVOICE_ID=$(fp POST /invoices @- <<JSON | jq -r .id
{"creditor_id": "$CREDITOR_ID", "debtor_id": "$DEBTOR_ID", "external_ref": "faktura-$RUN",
 "issue_date": "$TODAY", "due_date": "$DUE",
 "total": {"amount": 125000, "currency": "DKK"}, "vat_total": {"amount": 25000, "currency": "DKK"}}
JSON
)
fp GET "/invoices/$INVOICE_ID" | jq -c '{id, status, balance}'

fp POST /hosted-sessions @- <<JSON | jq -c '{id, status, url_set: (.url != null), expires_at}'
{"creditor_id": "$CREDITOR_ID", "debtor_id": "$DEBTOR_ID", "purpose": "pay", "invoice_id": "$INVOICE_ID"}
JSON

fp POST "/invoices/$INVOICE_ID/mark-paid" @- <<JSON | jq -c '{status, balance}'
{"amount": {"amount": 125000, "currency": "DKK"}, "paid_at": "$NOW",
 "payment_method": {"rail": "bank_transfer", "source": "external", "instrument": "bank_transfer"},
 "external_ref": "bank-$RUN", "note": "Betalt via netbank"}
JSON

INVOICE2_ID=$(fp POST /invoices @- <<JSON | jq -r .id
{"creditor_id": "$CREDITOR_ID", "debtor_id": "$DEBTOR_ID", "external_ref": "faktura-$RUN-2",
 "issue_date": "$TODAY", "due_date": "$DUE", "total": {"amount": 40000, "currency": "DKK"}}
JSON
)
# delvis kreditering: 100,00 kr. / partial credit: DKK 100.00
fp POST "/invoices/$INVOICE2_ID/credit" @- <<JSON | jq -c '{status, balance}'
{"amount": {"amount": 10000, "currency": "DKK"}, "reason": "Rabat aftalt", "external_ref": "kreditnota-$RUN"}
JSON

fp POST "/invoices/$INVOICE2_ID/credit" @- <<JSON | jq -c '{status, balance}'
{"amount": {"amount": 30000, "currency": "DKK"}, "reason": "Ordren annulleret", "external_ref": "kreditnota-$RUN-b"}
JSON

INVOICE3_ID=$(fp POST /invoices @- <<JSON | jq -r .id
{"creditor_id": "$CREDITOR_ID", "debtor_id": "$DEBTOR_ID", "external_ref": "faktura-$RUN-3",
 "issue_date": "$TODAY", "due_date": "$DUE", "total": {"amount": 20000, "currency": "DKK"}}
JSON
)
fp POST "/invoices/$INVOICE3_ID/mark-paid" @- <<JSON >/dev/null
{"amount": {"amount": 20000, "currency": "DKK"}, "paid_at": "$NOW",
 "payment_method": {"rail": "pos", "source": "external", "instrument": "cash"}, "external_ref": "kasse-$RUN"}
JSON
PAYMENT_ID=$(fp GET "/payments?external_ref=kasse-$RUN" | jq -r '.data[0].id')
echo "{\"payment_id\": \"$PAYMENT_ID\"}"

fp POST "/payments/$PAYMENT_ID/withdraw-registration" @- <<JSON | jq -c '{kind, reopens_invoice}'
{"reason": "Registreret ved en fejl — kunden betalte ikke i kassen"}
JSON
fp GET "/invoices/$INVOICE3_ID" | jq -c '{status, balance}'

# Gem secret med det samme — den vises kun her / store the secret now — it is shown only once
ENDPOINT=$(fp POST /webhook-endpoints @- <<JSON
{"url": "https://erp.example.com/webhooks/forta-pay", "creditor_id": "$CREDITOR_ID",
 "event_types": ["invoice.*", "payment.*"], "description": "Vores ERP"}
JSON
)
WEBHOOK_SECRET=$(jq -r .secret <<<"$ENDPOINT")
jq -c '{id, status, event_types, secret_prefix: (.secret[:6])}' <<<"$ENDPOINT"

# Første gang: start fra begyndelsen (ingen cursor). Gem next_cursor varigt efter hver side.
# First run: start from the beginning (no cursor). Persist next_cursor after every page.
CURSOR=""
while :; do
  SIDE=$(fp GET "/changes?limit=200${CURSOR:+&cursor=$CURSOR}")
  jq -r '.data[] | [.seq, .type, (.data.object.id // "")] | @tsv' <<<"$SIDE" | tail -3
  CURSOR=$(jq -r .next_cursor <<<"$SIDE")
  [ "$(jq -r .has_more <<<"$SIDE")" = true ] || break
done
echo "{\"cursor_set\": $([ -n "$CURSOR" ] && echo true || echo false)}"

import hashlib
import hmac
import time


def verify_forta_pay_signature(secret: str, headers: dict, body: bytes, tolerance: int = 300) -> bool:
    """True when the webhook really comes from Forta Pay. `body` is the RAW request body (bytes)."""
    h = {k.lower(): v for k, v in headers.items()}
    event_id = h.get("forta-pay-event-id", "")
    timestamp = h.get("forta-pay-timestamp", "")
    if not timestamp.isdigit() or abs(time.time() - int(timestamp)) > tolerance:
        return False
    signed = f"{event_id}.{timestamp}.".encode() + body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    # During a secret rotation the header carries two values: "v1=<new> v1=<old>"
    return any(part.startswith("v1=") and hmac.compare_digest(part[3:], expected)
               for part in h.get("forta-pay-signature", "").split())