RetentBase API integration guide

await fetch("https://api.retentbase.com/api/v1/cancellations", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: "Bearer " + process.env.RETENTBASE_API_KEY,
  },
  body: JSON.stringify({
    environment: "sandbox",
    eventId: "cancel_evt_8f30a7bf",
    userId: "user_456",
    reasonKey: "too_expensive",
    outcome: "churned", // omit to leave outcome pending for PATCH
    offer: {
      type: "discount",
      accepted: true,
      label: "20% off next month",
    },
    reasonText: "Needs lower monthly price",
    context: {
      plan: "pro",
      mrr: 129,
      tenureDays: 42,
    },
    occurredAt: new Date().toISOString(),
    metadata: {
      source: "billing_settings_page",
    },
  }),
});

await fetch("https://api.retentbase.com/api/v1/cancellations/cancel_evt_8f30a7bf", {
  method: "PATCH",
  headers: {
    "Content-Type": "application/json",
    Authorization: "Bearer " + process.env.RETENTBASE_API_KEY,
  },
  body: JSON.stringify({
    environment: "sandbox",
    outcome: "recovered",
    effectiveAt: new Date().toISOString(),
    metadata: {
      actor: "success_playbook",
      channel: "cs_call",
    },
  }),
});

import crypto from "node:crypto";

export async function POST(request: Request) {
  const timestamp = request.headers.get("x-retentbase-timestamp");
  const signature = request.headers.get("x-retentbase-signature-sha256");

  if (!timestamp || !signature) {
    return new Response("Missing signature headers", { status: 400 });
  }

  const unixTimestamp = Number(timestamp);
  if (!Number.isFinite(unixTimestamp) || Math.abs(Date.now() / 1000 - unixTimestamp) > 300) {
    return new Response("Stale webhook timestamp", { status: 401 });
  }

  const rawBody = await request.text();
  const expected = crypto
    .createHmac("sha256", process.env.RETENTBASE_SIGNING_SECRET!)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  const valid =
    expected.length === signature.length &&
    crypto.timingSafeEqual(Buffer.from(expected, "utf8"), Buffer.from(signature, "utf8"));

  if (!valid) {
    return new Response("Invalid signature", { status: 401 });
  }

  const deliveryId = request.headers.get("x-retentbase-delivery-id");
  // Persist deliveryId to reject duplicate deliveries idempotently.

  const event = JSON.parse(rawBody);
  return new Response("ok", { status: 200 });
}