# Community examples

Copy these into your automation tool. Secrets are shown once in the dashboard (`whsec_…`, `hooksec_…`) — never commit them.

## Verify an outbound webhook (Node)

```js
import crypto from "node:crypto";

export function valid(secret, timestamp, body, signatureHex) {
  const mac = crypto.createHmac("sha256", secret)
    .update(`${timestamp}.`)
    .update(body)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(mac), Buffer.from(signatureHex.toLowerCase()));
}
```

Headers: `X-Werkmail-Signature`, `X-Werkmail-Timestamp`, `X-Werkmail-Event`.

## Verify (Go)

```go
mac := hmac.New(sha256.New, []byte(secret))
mac.Write([]byte(timestamp + "."))
mac.Write(body)
ok := hmac.Equal([]byte(hex.EncodeToString(mac.Sum(nil))), []byte(strings.ToLower(sig)))
```

Python is in the [Webhooks](/webhooks) guide.

## n8n / Make

Blueprints live in the repository under `docs/integrations/`:

| File | Flow |
| --- | --- |
| `n8n-form-doi.json` | Website form → DOI / newsletter |
| `n8n-calendar-termin.json` | Calendar → Termin + ICS |
| `n8n-bounce-slack.json` | Outbound bounce webhook → Slack |
| `make-form-doi.json` | Make.com form → DOI |

Typical mapping: capture email + consent checkbox → `POST /api/public/subscribe` **or** inbound send with `message_kind: doi`.

## Inbound send (PVS / form)

```http
POST /api/public/hooks/{practiceID}/send
Content-Type: application/json
X-Werkmail-Hook-Secret: hooksec_…

{
  "to": "patient@example.com",
  "subject": "Ihre Terminbestätigung",
  "text": "Ihr Termin …",
  "message_kind": "termin"
}
```

## BI export

Authenticated CSV:

- `/api/practices/{id}/exports/bi?kind=stats&days=30`
- `kind=campaigns` · `kind=bounces` · `kind=scores`

Deliverability cockpit also lists these links.