Send a contract from your CRM

curl -X POST https://app.sajn.se/api/v1/webhooks \
  -H "Authorization: Bearer $SAJN_API_KEY" \
  -H "Sajn-Version: 2026-10" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://crm.example.com/webhooks/sajn",
    "events": ["document.completed", "document.rejected", "document.expired"],
    "enabled": true,
    "apiVersion": "2026-10"
  }'

// sajn.js
const API = "https://app.sajn.se/api/v1";

export const sajn = async (method, path, body, idempotencyKey) => {
  const response = await fetch(`${API}${path}`, {
    method,
    headers: {
      Authorization: `Bearer ${process.env.SAJN_API_KEY}`,
      "Sajn-Version": "2026-10",
      "Content-Type": "application/json",
      ...(idempotencyKey ? { "Idempotency-Key": idempotencyKey } : {}),
    },
    body: body === undefined ? undefined : JSON.stringify(body),
  });
  const data = await response.json();
  if (!response.ok) {
    throw new Error(`${method} ${path}: ${data.code} ${data.message} (${data.requestId})`);
  }
  return data;
};

// send-contract.js
import { sajn } from "./sajn.js";

export const sendContract = async (deal) => {
  const document = await sajn("POST", "/documents", {
    name: `Service agreement - ${deal.companyName}`,
    templateId: process.env.SAJN_TEMPLATE_ID,
    externalId: deal.id,
  }, `contract-${deal.id}-create`);

  const { results } = await sajn("PATCH", `/documents/${document.id}/field-values`, {
    values: [
      { key: "customer-name", value: deal.companyName },
      { key: "org-number", value: deal.orgNumber },
      { key: "contract-value", value: String(deal.value) },
    ],
  });
  const failed = results.filter((result) => !result.success);
  if (failed.length > 0) {
    throw new Error(`Values not written: ${failed.map((result) => `${result.key} ${result.error.code}`).join(", ")}`);
  }

  const customer = document.parties.find((party) => party.name === "Customer");
  await sajn("PATCH", `/documents/${document.id}/parties/${customer.id}`, {
    name: deal.contactName,
    email: deal.contactEmail,
  });

  await sajn("POST", `/documents/${document.id}/send`, {}, `contract-${deal.id}-send`);
  return document.id;
};

// server.js
import crypto from "node:crypto";
import { writeFile } from "node:fs/promises";

import express from "express";

import { sajn } from "./sajn.js";

const isSignedBySajn = (headers, rawBody) => {
  const id = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];
  if (!id || Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
  const key = Buffer.from(process.env.SAJN_WEBHOOK_SECRET.replace(/^whsec_/, ""), "base64");
  const expected = crypto.createHmac("sha256", key).update(`${id}.${timestamp}.${rawBody}`).digest();
  return String(headers["webhook-signature"] ?? "")
    .split(" ")
    .some((entry) => {
      const [version, signature = ""] = entry.split(",");
      const received = Buffer.from(signature, "base64");
      return version === "v1" && received.length === expected.length && crypto.timingSafeEqual(received, expected);
    });
};

const handled = new Set(); // Use your database in production.

const app = express();

app.post("/webhooks/sajn", express.raw({ type: "application/json" }), async (req, res) => {
  if (!isSignedBySajn(req.headers, req.body)) return res.status(401).end();
  res.status(200).end();

  const event = JSON.parse(req.body);
  if (handled.has(event.id)) return;
  handled.add(event.id);

  const document = event.data.object;
  const dealId = document.externalId;

  if (event.type === "document.completed") {
    const { url } = await sajn("GET", `/documents/${document.id}/files/SIGNED`);
    const pdf = Buffer.from(await (await fetch(url)).arrayBuffer());
    await writeFile(`contracts/${dealId}.pdf`, pdf);
    console.log(`Deal ${dealId}: signed`); // Replace with your CRM update.
  } else {
    console.log(`Deal ${dealId}: ${event.type}`); // Rejected or expired.
  }
});

app.listen(3000);