Community examples

Copy these into your automation tool. Secrets are shown once in the dashboard (whsec_…, hooksec_…) — never commit them.

Verify an outbound webhook (Node)

import crypto from "node:crypto";

export function valid(secret, timestamp, body, signatureHex) {
  const mac = crypto.createHmac("sha256", secret)
    .update(`${timestamp}.`)
    .update(body)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(mac), Buffer.from(signatureHex.toLowerCase()));
}

Headers: X-Werkmail-Signature, X-Werkmail-Timestamp, X-Werkmail-Event.

Verify (Go)

mac := hmac.New(sha256.New, []byte(secret))
mac.Write([]byte(timestamp + "."))
mac.Write(body)
ok := hmac.Equal([]byte(hex.EncodeToString(mac.Sum(nil))), []byte(strings.ToLower(sig)))

Python is in the Webhooks guide.

n8n / Make

Blueprints live in the repository under docs/integrations/:

File	Flow
`n8n-form-doi.json`	Website form → DOI / newsletter
`n8n-calendar-termin.json`	Calendar → Termin + ICS
`n8n-bounce-slack.json`	Outbound bounce webhook → Slack
`make-form-doi.json`	Make.com form → DOI

Typical mapping: capture email + consent checkbox → POST /api/public/subscribe or inbound send with message_kind: doi.

Inbound send (PVS / form)

POST /api/public/hooks/{practiceID}/send
Content-Type: application/json
X-Werkmail-Hook-Secret: hooksec_…

{
  "to": "patient@example.com",
  "subject": "Ihre Terminbestätigung",
  "text": "Ihr Termin …",
  "message_kind": "termin"
}

BI export

Authenticated CSV:

/api/practices/{id}/exports/bi?kind=stats&days=30
kind=campaigns · kind=bounces · kind=scores

Deliverability cockpit also lists these links.