Webhooks and hooks

POST /wp-json/agoo/v1/webhooks

do_action( 'agoo_webhook_received', array $event );

[
    'id'              => 'evt_01jpb0nr5yhcf05g59s2s1kke5',
    'type'            => 'visit.checked_in',
    'created_at'      => '2026-10-14T09:31:02Z',
    'organisation_id' => 'org_01kjpsrza0etzb0a4vf72x8ang',
    'livemode'        => true,
    'data'            => [ 'object' => [ /* the visit, booking, delivery… */ ] ],
]

add_action( 'agoo_webhook_received', function ( array $event ): void {
	if ( defined( 'WP_DEBUG_LOG' ) && WP_DEBUG_LOG ) {
		error_log( sprintf( 'Agoo event %s (%s)', $event['type'], $event['id'] ) );
	}
} );

do_action( 'agoo_visit_checked_in', array $visit );

apply_filters( 'agoo_embed_attributes', array $attributes, string $widget, array $settings );

add_filter( 'agoo_embed_attributes', function ( array $attributes, string $widget, array $settings ): array {
	if ( 'booking' !== $widget || ! is_user_logged_in() ) {
		return $attributes;
	}

	$phone = get_user_meta( get_current_user_id(), 'billing_phone', true );
	if ( is_string( $phone ) && '' !== $phone ) {
		$attributes['data-agoo-phone'] = $phone;
	}

	return $attributes;
}, 10, 3 );

apply_filters( 'agoo_embed_script_url', string $url );

add_filter( 'agoo_embed_script_url', function ( string $url ): string {
	return 'https://static.example.org/vendor/agoo/v1/embed.js';
} );

define( 'MYSITE_SLACK_WEBHOOK_URL', 'https://hooks.slack.com/services/…' );

<?php
/**
 * Plugin Name: Agoo arrivals to Slack
 */

add_action( 'agoo_visit_checked_in', function ( array $visit ): void {
	if ( ! defined( 'MYSITE_SLACK_WEBHOOK_URL' ) ) {
		return;
	}

	$name    = $visit['visitor']['name'] ?? 'A visitor';
	$company = $visit['visitor']['company'] ?? '';
	$time    = wp_date( 'H:i', strtotime( $visit['checked_in_at'] ), new DateTimeZone( 'Africa/Accra' ) );

	$text = $company
		? sprintf( '%s (%s) checked in at %s.', $name, $company, $time )
		: sprintf( '%s checked in at %s.', $name, $time );

	$response = wp_remote_post( MYSITE_SLACK_WEBHOOK_URL, [
		'headers' => [ 'Content-Type' => 'application/json' ],
		'body'    => wp_json_encode( [ 'text' => $text ] ),
		'timeout' => 5,
	] );

	if ( is_wp_error( $response ) ) {
		error_log( 'Agoo to Slack failed: ' . $response->get_error_message() );
	}
} );

<?php
/**
 * Plugin Name: Agoo visitors to CRM
 */

// 1. On check-in, queue a job with only the fields the CRM needs.
add_action( 'agoo_visit_checked_in', function ( array $visit ): void {
	$visitor = $visit['visitor'] ?? [];
	if ( empty( $visitor['email'] ) ) {
		return; // nothing to match the contact on
	}

	wp_schedule_single_event( time(), 'mysite_agoo_add_crm_contact', [
		[
			'agoo_visit_id' => $visit['id'],
			'name'          => $visitor['name'] ?? '',
			'email'         => $visitor['email'],
			'phone'         => $visitor['phone'] ?? '',
			'company'       => $visitor['company'] ?? '',
		],
	] );
} );

// 2. The job calls the CRM's API. Define MYSITE_CRM_TOKEN in wp-config.php.
add_action( 'mysite_agoo_add_crm_contact', function ( array $contact ): void {
	$response = wp_remote_post( 'https://crm.example/api/v2/contacts', [
		'headers' => [
			'Authorization' => 'Bearer ' . MYSITE_CRM_TOKEN,
			'Content-Type'  => 'application/json',
		],
		'body'    => wp_json_encode( [
			'name'    => $contact['name'],
			'email'   => $contact['email'],
			'phone'   => $contact['phone'],
			'company' => $contact['company'],
			'source'  => 'Agoo visit ' . $contact['agoo_visit_id'],
		] ),
		'timeout' => 15,
	] );

	if ( is_wp_error( $response ) || wp_remote_retrieve_response_code( $response ) >= 300 ) {
		error_log( 'CRM contact failed for ' . $contact['agoo_visit_id'] );
	}
} );

/**
 * Verifies an Agoo webhook (Standard Webhooks). Returns true only for a genuine, fresh event.
 */
function mysite_agoo_verify( string $body, string $id, string $timestamp, string $signatures, string $secret, int $tolerance = 300 ): bool {
	if ( '' === $id || ! ctype_digit( $timestamp ) || '' === $signatures ) {
		return false;
	}
	if ( abs( time() - (int) $timestamp ) > $tolerance ) {
		return false;
	}

	// The key is the base64 part of the secret, after "whsec_".
	$key = base64_decode( preg_replace( '/^whsec_/', '', $secret ), true );
	if ( false === $key ) {
		return false;
	}
	$expected = base64_encode( hash_hmac( 'sha256', "{$id}.{$timestamp}.{$body}", $key, true ) );

	// The header can hold several space-separated "v1,<signature>" values.
	foreach ( explode( ' ', $signatures ) as $entry ) {
		[ $version, $signature ] = array_pad( explode( ',', $entry, 2 ), 2, '' );
		if ( 'v1' === $version && hash_equals( $expected, $signature ) ) {
			return true;
		}
	}
	return false;
}

add_action( 'rest_api_init', function (): void {
	register_rest_route( 'mysite/v1', '/agoo-events', [
		'methods'             => 'POST',
		'callback'            => 'mysite_handle_agoo_event',
		'permission_callback' => '__return_true', // Agoo can't log in; the signature is checked below
	] );
} );

function mysite_handle_agoo_event( WP_REST_Request $request ) {
	$body = $request->get_body(); // the raw body: verify before decoding

	$valid = mysite_agoo_verify(
		$body,
		(string) $request->get_header( 'webhook-id' ),
		(string) $request->get_header( 'webhook-timestamp' ),
		(string) $request->get_header( 'webhook-signature' ),
		MYSITE_AGOO_WEBHOOK_SECRET
	);
	if ( ! $valid ) {
		return new WP_Error( 'agoo_invalid_signature', 'Invalid signature.', [ 'status' => 400 ] );
	}

	$event = json_decode( $body, true );
	// De-duplicate on webhook-id, then handle $event['type'] …

	return new WP_REST_Response( null, 204 );
}