{
  "event": "string",
  "timestamp": "ISO 8601 datetime",
  "data": { ... }
}

{
  "event": "feedback.created",
  "timestamp": "2026-01-07T15:30:00.000Z",
  "data": {
    "id": "fb_abc123xyz",
    "projectId": "proj_xyz789",
    "widgetId": "w_default",
    "widgetName": "Main Feedback Widget",
    "template": "floating",
    
    "message": "The export button doesn't work when I select more than 100 items. I've tried multiple times with different browsers.",
    "category": "bug",
    "rating": 2,
    "email": "user@example.com",
    
    "status": "new",
    
    "screenshotUrl": "https://storage.userhero.co/screenshots/fb_abc123xyz.png",
    
    "context": {
      "pageUrl": "/dashboard/reports",
      "fullUrl": "https://app.example.com/dashboard/reports?view=list",
      "referrer": "https://app.example.com/dashboard",
      "browser": "Chrome",
      "browserVersion": "120.0.6099.129",
      "os": "macOS",
      "osVersion": "14.2",
      "deviceType": "desktop",
      "viewport": {
        "width": 1920,
        "height": 1080
      },
      "timezone": "America/New_York",
      "locale": "en-US",
      "country": "US"
    },
    
    "metadata": {
      "userId": "user_123",
      "plan": "pro",
      "company": "Acme Inc",
      "accountId": "acc_456",
      "role": "admin"
    },
    
    "createdAt": "2026-01-07T15:30:00.000Z"
  }
}

{
  "event": "feedback.updated",
  "timestamp": "2026-01-07T16:45:00.000Z",
  "data": {
    "id": "fb_abc123xyz",
    "projectId": "proj_xyz789",
    "previousStatus": "new",
    "newStatus": "in-progress",
    "updatedBy": {
      "id": "user_team123",
      "email": "team@example.com",
      "name": "John Smith"
    },
    "updatedAt": "2026-01-07T16:45:00.000Z"
  }
}

X-UserHero-Signature: sha256=abc123def456...

const crypto = require('crypto');

function verifySignature(payload, signature, secret) {
  const expectedSignature = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(payload))
    .digest('hex');
  
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

// Usage
app.post('/webhook', (req, res) => {
  const signature = req.headers['x-userhero-signature'];
  
  if (!verifySignature(req.body, signature, WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  
  // Process webhook
  const { event, data } = req.body;
  // ...
  
  res.status(200).json({ received: true });
});