ابدأ من هنا

curl -s "$TABLA_API/oauth/token" \
  -u "$TABLA_CLIENT_ID:$TABLA_CLIENT_SECRET" \
  -d grant_type=client_credentials \
  -d "scope=messages:send messages:read"

{
  "access_token": "eyJhbGciOiJIUzI1NiJ9…",
  "token_type": "Bearer",
  "expires_in": 600,
  "scope": "messages:read messages:send"
}

curl -s -X PUT "$TABLA_API/v1/recipients/user-42" \
  -H "Authorization: Bearer $TABLA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "locale": "ar",
    "phone": "+201001234567",
    "phoneVerified": true,
    "email": "mona@example.com"
  }'

curl -s -X PUT "$TABLA_API/v1/templates/booking.confirmed" \
  -H "Authorization: Bearer $TABLA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "category": "TRANSACTIONAL",
    "push": {
      "ar": { "title": "اتأكد حجزك", "body": "مستنيينك الساعة {{hour}} يا {{name}}." },
      "en": { "title": "Booking confirmed", "body": "See you at {{hour}}, {{name}}." }
    },
    "sms": {
      "ar": { "text": "اتأكد حجزك الساعة {{hour}}." },
      "en": { "text": "Your booking at {{hour}} is confirmed." }
    }
  }'

curl -s "$TABLA_API/v1/messages" \
  -H "Authorization: Bearer $TABLA_TOKEN" \
  -H "Idempotency-Key: booking-8f2c41-confirmed" \
  -H "Content-Type: application/json" \
  -d '{
    "recipient": { "id": "user-42" },
    "template": "booking.confirmed",
    "data": { "name": "Mona", "hour": 18 },
    "options": {
      "fallback": ["PUSH", "SMS"],
      "pushData": { "type": "booking", "bookingId": "8f2c41" }
    }
  }'

HTTP/1.1 202 Accepted
Idempotent-Replayed: false

{ "id": "6b0e2c1a-3d4f-4e5a-9b8c-7d6e5f4a3b2c", "status": "ACCEPTED" }

curl -s "$TABLA_API/v1/messages" \
  -H "Authorization: Bearer $TABLA_TOKEN" \
  -H "Idempotency-Key: otp-$(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "recipient": { "phone": "+201001234567", "locale": "ar" },
    "template": "auth.otp",
    "data": { "code": "482913" }
  }'

GET /v1/messages/6b0e2c1a-…
{
  "id": "6b0e2c1a-3d4f-4e5a-9b8c-7d6e5f4a3b2c",
  "status": "SENT",
  "template": "booking.confirmed",
  "lane": "TRANSACTIONAL",
  "channels": [
    { "leg": 0, "channel": "PUSH", "status": "FAILED" },
    { "leg": 0, "channel": "SMS", "status": "SENT" }
  ]
}

POST /tabla/webhooks HTTP/1.1
Content-Type: application/json
Tabla-Signature: t=1791651600,v1=5f0c…e2
Tabla-Event-Id: 0b8e6a1c-2f4d-4e7b-9c1a-6d3f8e2b5a70
User-Agent: Tabla-Webhooks/1

{
  "id": "0b8e6a1c-2f4d-4e7b-9c1a-6d3f8e2b5a70",
  "type": "message.failed",
  "createdAt": "2026-10-09T12:40:00Z",
  "data": {
    "messageId": "6b0e2c1a-3d4f-4e5a-9b8c-7d6e5f4a3b2c",
    "status": "FAILED",
    "template": "booking.confirmed",
    "recipientId": "user-42",
    "legs": [{ "leg": 0, "channel": "SMS", "status": "FAILED" }]
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

const TOLERANCE_SECONDS = 5 * 60;

/**
 * rawBody: the request body exactly as received (a Buffer or string), before any JSON parsing.
 * header: the Tabla-Signature header. secret: your whsec_… signing secret.
 */
export function verifyTablaSignature(rawBody, header, secret, nowMs = Date.now()) {
  const parts = Object.fromEntries(
    String(header ?? "").split(",").map((part) => part.trim().split("=")),
  );
  const t = Number(parts.t);
  if (!Number.isInteger(t) || !/^[0-9a-f]{64}$/.test(parts.v1 ?? "")) return false;
  if (Math.abs(nowMs / 1000 - t) > TOLERANCE_SECONDS) return false;
  const expected = createHmac("sha256", secret).update(`${t}.`).update(rawBody).digest();
  return timingSafeEqual(expected, Buffer.from(parts.v1, "hex"));
}

import hashlib
import hmac
import time

TOLERANCE_SECONDS = 5 * 60


def verify_tabla_signature(raw_body: bytes, header: str, secret: str, now: float | None = None) -> bool:
    """raw_body: the request body exactly as received, before any JSON parsing."""
    try:
        parts = dict(part.strip().split("=", 1) for part in header.split(","))
        t = int(parts["t"])
        given = parts["v1"]
    except (KeyError, ValueError):
        return False
    if abs((time.time() if now is None else now) - t) > TOLERANCE_SECONDS:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, given)

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.time.Instant;
import java.util.HexFormat;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

final class TablaWebhooks {

    private static final long TOLERANCE_SECONDS = 5 * 60;

    /** rawBody: the request body exactly as received, before any JSON parsing. */
    static boolean verify(byte[] rawBody, String header, String secret, Instant now) throws Exception {
        String t = null;
        String v1 = null;
        for (String part : header.split(",")) {
            String[] kv = part.trim().split("=", 2);
            if (kv.length == 2 && kv[0].equals("t")) t = kv[1];
            if (kv.length == 2 && kv[0].equals("v1")) v1 = kv[1];
        }
        if (t == null || v1 == null) return false;
        long timestamp;
        byte[] given;
        try {
            timestamp = Long.parseLong(t);
            given = HexFormat.of().parseHex(v1);
        } catch (IllegalArgumentException e) {
            return false;
        }
        if (Math.abs(now.getEpochSecond() - timestamp) > TOLERANCE_SECONDS) return false;
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        mac.update((timestamp + ".").getBytes(StandardCharsets.UTF_8));
        return MessageDigest.isEqual(mac.doFinal(rawBody), given);
    }
}

import 'dart:convert';

import 'package:crypto/crypto.dart';

const toleranceSeconds = 5 * 60;

/// [rawBody]: the request body exactly as received, before any JSON parsing.
bool verifyTablaSignature(List<int> rawBody, String header, String secret, {DateTime? now}) {
  final parts = <String, String>{};
  for (final part in header.split(',')) {
    final i = part.indexOf('=');
    if (i > 0) parts[part.substring(0, i).trim()] = part.substring(i + 1).trim();
  }
  final t = int.tryParse(parts['t'] ?? '');
  final given = parts['v1'];
  if (t == null || given == null) return false;
  final nowSeconds = (now ?? DateTime.now()).millisecondsSinceEpoch ~/ 1000;
  if ((nowSeconds - t).abs() > toleranceSeconds) return false;
  final expected = Hmac(sha256, utf8.encode(secret)).convert([...utf8.encode('$t.'), ...rawBody]).toString();
  return _constantTimeEquals(expected, given);
}

bool _constantTimeEquals(String a, String b) {
  if (a.length != b.length) return false;
  var diff = 0;
  for (var i = 0; i < a.length; i++) {
    diff |= a.codeUnitAt(i) ^ b.codeUnitAt(i);
  }
  return diff == 0;
}

HTTP/1.1 400 Bad Request
Content-Type: application/problem+json

{
  "type": "urn:tabla:problem:MESSAGE_DATA_MISSING",
  "title": "Bad Request",
  "status": 400,
  "code": "MESSAGE_DATA_MISSING",
  "detail": "The message lacks variables the template needs."
}

HTTP/1.1 429 Too Many Requests
Retry-After: 17
Content-Type: application/problem+json

{ "status": 429, "code": "RATE_LIMITED", "detail": "Too many requests this minute." }