Testing your endpoint

# Replay a captured event against your local server
curl -X POST http://localhost:3000/webhooks/fpt \
  -H "Content-Type: application/json" \
  -H "X-FPT-Signature: t=1717023600,v1=a3f8c2e7d1..." \
  --data-binary @captured-event.json

import fs from "node:fs";

const event = JSON.parse(fs.readFileSync("captured-event.json", "utf8"));
const signature = "t=1717023600,v1=a3f8c2e7d1...";  // copy from captured headers

const response = await fetch("http://localhost:3000/webhooks/fpt", {
    method: "POST",
    headers: {
        "Content-Type": "application/json",
        "X-FPT-Signature": signature,
    },
    body: JSON.stringify(event),
});
console.log(response.status);

import crypto from "node:crypto";

function buildSignedRequest(event, secret) {
    const rawBody = JSON.stringify(event);
    const t = Math.floor(Date.now() / 1000);
    const v1 = crypto.createHmac("sha256", secret)
        .update(`${t}.${rawBody}`)
        .digest("hex");
    return {
        body: rawBody,
        headers: { "x-fpt-signature": `t=${t},v1=${v1}` },
    };
}

test("handles contact.sub_group_changed", async () => {
    const event = {
        eventId: "test-" + crypto.randomBytes(16).toString("hex"),
        eventType: "contact.sub_group_changed",
        eventTimestamp: new Date().toISOString(),
        locationId: 1234,
        organizationId: 5678,
        apiVersion: "2026-05-29",
        data: { contactId: 9876, previousSubGroupId: 3, newSubGroupId: 7 },
    };
    const req = buildSignedRequest(event, process.env.FPT_WEBHOOK_SECRET);
    const res = await myHandler(req);
    expect(res.status).toBe(200);
    // ... assert your side effects
});

import hmac
import hashlib
import json
import time
import secrets

def build_signed_request(event, secret):
    raw_body = json.dumps(event).encode()
    t = int(time.time())
    v1 = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return {
        "body": raw_body,
        "headers": {"X-FPT-Signature": f"t={t},v1={v1}"},
    }

def test_handles_contact_sub_group_changed():
    event = {
        "eventId": "test-" + secrets.token_hex(16),
        "eventType": "contact.sub_group_changed",
        "eventTimestamp": "2026-06-10T23:45:00Z",
        "locationId": 1234,
        "organizationId": 5678,
        "apiVersion": "2026-05-29",
        "data": {"contactId": 9876, "previousSubGroupId": 3, "newSubGroupId": 7},
    }
    req = build_signed_request(event, os.environ["FPT_WEBHOOK_SECRET"])
    res = my_handler(req)
    assert res.status == 200
    # ... assert your side effects