Integrando com o Efrat

curl -X POST "https://api.efrat.com.br/api/integration/token" \
  -H "Content-Type: application/json" \
  -d '{"clientId":"ic_4f9a1c0e7b2d8a6e3c5b1f07","clientSecret":"SEU_CLIENT_SECRET"}'

// Node.js 18+ (fetch nativo)
const res = await fetch('https://api.efrat.com.br/api/integration/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    clientId: process.env.EFRAT_CLIENT_ID,
    clientSecret: process.env.EFRAT_CLIENT_SECRET,
  }),
});
if (!res.ok) throw new Error(`Login falhou: ${res.status}`);
const { accessToken, expiresIn } = await res.json();

import os, requests

res = requests.post(
    "https://api.efrat.com.br/api/integration/token",
    json={"clientId": os.environ["EFRAT_CLIENT_ID"], "clientSecret": os.environ["EFRAT_CLIENT_SECRET"]},
    timeout=30,
)
res.raise_for_status()
token = res.json()["accessToken"]

using System.Net.Http.Json;

var http = new HttpClient { BaseAddress = new Uri("https://api.efrat.com.br") };
var res = await http.PostAsJsonAsync("/api/integration/token", new
{
    clientId = Environment.GetEnvironmentVariable("EFRAT_CLIENT_ID"),
    clientSecret = Environment.GetEnvironmentVariable("EFRAT_CLIENT_SECRET"),
});
res.EnsureSuccessStatusCode();
var login = await res.Content.ReadFromJsonAsync<TokenResponse>();

record TokenResponse(string AccessToken, string TokenType, int ExpiresIn);

<?php
$ch = curl_init('https://api.efrat.com.br/api/integration/token');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode([
        'clientId' => getenv('EFRAT_CLIENT_ID'),
        'clientSecret' => getenv('EFRAT_CLIENT_SECRET'),
    ]),
]);
$body = json_decode(curl_exec($ch), true);
$token = $body['accessToken'];

# Consultar
curl "https://api.efrat.com.br/api/uniques?page=1&pageSize=20" \
  -H "Authorization: Bearer $TOKEN"

# Incluir
curl -X POST "https://api.efrat.com.br/api/cost-centers" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"code":"0010","description":"Marketing"}'

const api = (path, options = {}) =>
  fetch(`https://api.efrat.com.br${path}`, {
    ...options,
    headers: { Authorization: `Bearer ${accessToken}`, 'Content-Type': 'application/json', ...options.headers },
  });

// Consultar
const pessoas = await (await api('/api/uniques?page=1&pageSize=20')).json();

// Incluir
const res = await api('/api/cost-centers', {
  method: 'POST',
  body: JSON.stringify({ code: '0010', description: 'Marketing' }),
});
const criado = await res.json();

s = requests.Session()
s.headers.update({"Authorization": f"Bearer {token}"})
base = "https://api.efrat.com.br"

# Consultar
pessoas = s.get(f"{base}/api/uniques", params={"page": 1, "pageSize": 20}, timeout=30).json()

# Incluir
criado = s.post(f"{base}/api/cost-centers", json={"code": "0010", "description": "Marketing"}, timeout=30).json()

http.DefaultRequestHeaders.Authorization =
    new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", login!.AccessToken);

// Consultar
var pessoas = await http.GetFromJsonAsync<JsonElement>("/api/uniques?page=1&pageSize=20");

// Incluir
var res = await http.PostAsJsonAsync("/api/cost-centers", new { code = "0010", description = "Marketing" });
res.EnsureSuccessStatusCode();

<?php
function efrat($method, $path, $token, $body = null) {
    $ch = curl_init('https://api.efrat.com.br' . $path);
    $headers = ['Authorization: Bearer ' . $token, 'Content-Type: application/json'];
    curl_setopt_array($ch, [CURLOPT_CUSTOMREQUEST => $method, CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => $headers]);
    if ($body !== null) curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($body));
    $response = json_decode(curl_exec($ch), true);
    $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    return [$status, $response];
}

[$status, $pessoas] = efrat('GET', '/api/uniques?page=1&pageSize=20', $token);
[$status, $criado] = efrat('POST', '/api/cost-centers', $token, ['code' => '0010', 'description' => 'Marketing']);

// efrat.js — Node.js 18+
const BASE = 'https://api.efrat.com.br';
let token = null, expiresAt = 0;

async function login() {
  const res = await fetch(`${BASE}/api/integration/token`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ clientId: process.env.EFRAT_CLIENT_ID, clientSecret: process.env.EFRAT_CLIENT_SECRET }),
  });
  if (!res.ok) throw new Error(`Login Efrat falhou (${res.status})`);
  const data = await res.json();
  token = data.accessToken;
  expiresAt = Date.now() + (data.expiresIn - 120) * 1000; // renova 2 min antes
}

export async function efrat(method, path, body, retried = false) {
  if (!token || Date.now() > expiresAt) await login();
  const res = await fetch(`${BASE}${path}`, {
    method,
    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
    body: body ? JSON.stringify(body) : undefined,
  });
  if (res.status === 401 && !retried) { token = null; return efrat(method, path, body, true); }
  if (!res.ok) throw new Error(`${method} ${path} → ${res.status}: ${await res.text()}`);
  return res.status === 204 ? null : res.json();
}

// Uso
const lancamentos = await efrat('GET', '/api/financial-entries?page=1&pageSize=50&type=Receber');

# efrat.py
import os, time, requests

BASE = "https://api.efrat.com.br"

class Efrat:
    def __init__(self):
        self.token, self.expires_at = None, 0
        self.http = requests.Session()

    def _login(self):
        r = self.http.post(f"{BASE}/api/integration/token", json={
            "clientId": os.environ["EFRAT_CLIENT_ID"],
            "clientSecret": os.environ["EFRAT_CLIENT_SECRET"],
        }, timeout=30)
        r.raise_for_status()
        data = r.json()
        self.token = data["accessToken"]
        self.expires_at = time.time() + data["expiresIn"] - 120

    def request(self, method, path, body=None, retried=False):
        if not self.token or time.time() > self.expires_at:
            self._login()
        r = self.http.request(method, f"{BASE}{path}", json=body, timeout=60,
                              headers={"Authorization": f"Bearer {self.token}"})
        if r.status_code == 401 and not retried:
            self.token = None
            return self.request(method, path, body, True)
        r.raise_for_status()
        return None if r.status_code == 204 else r.json()

efrat = Efrat()
lancamentos = efrat.request("GET", "/api/financial-entries?page=1&pageSize=50&type=Receber")

// EfratClient.cs — .NET 8+
using System.Net;
using System.Net.Http.Headers;
using System.Net.Http.Json;

public sealed class EfratClient(HttpClient http, string clientId, string clientSecret)
{
    private string? _token;
    private DateTime _expiresAt;

    private async Task LoginAsync()
    {
        var res = await http.PostAsJsonAsync("https://api.efrat.com.br/api/integration/token", new { clientId, clientSecret });
        res.EnsureSuccessStatusCode();
        var data = (await res.Content.ReadFromJsonAsync<TokenResponse>())!;
        _token = data.AccessToken;
        _expiresAt = DateTime.UtcNow.AddSeconds(data.ExpiresIn - 120);
    }

    public async Task<HttpResponseMessage> SendAsync(HttpMethod method, string path, object? body = null, bool retried = false)
    {
        if (_token is null || DateTime.UtcNow > _expiresAt) await LoginAsync();
        var req = new HttpRequestMessage(method, "https://api.efrat.com.br" + path);
        req.Headers.Authorization = new AuthenticationHeaderValue("Bearer", _token);
        if (body is not null) req.Content = JsonContent.Create(body);
        var res = await http.SendAsync(req);
        if (res.StatusCode == HttpStatusCode.Unauthorized && !retried) { _token = null; return await SendAsync(method, path, body, true); }
        return res;
    }

    private sealed record TokenResponse(string AccessToken, string TokenType, int ExpiresIn);
}

<?php
// efrat.php
class Efrat {
    private $base = 'https://api.efrat.com.br';
    private $token = null;
    private $expiresAt = 0;

    private function call($method, $url, $headers, $body = null) {
        $ch = curl_init($url);
        curl_setopt_array($ch, [CURLOPT_CUSTOMREQUEST => $method, CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => $headers, CURLOPT_TIMEOUT => 60]);
        if ($body !== null) curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($body));
        $resp = curl_exec($ch);
        return [curl_getinfo($ch, CURLINFO_HTTP_CODE), json_decode($resp, true)];
    }

    private function login() {
        [$status, $data] = $this->call('POST', $this->base . '/api/integration/token', ['Content-Type: application/json'],
            ['clientId' => getenv('EFRAT_CLIENT_ID'), 'clientSecret' => getenv('EFRAT_CLIENT_SECRET')]);
        if ($status !== 200) throw new Exception('Login Efrat falhou: ' . $status);
        $this->token = $data['accessToken'];
        $this->expiresAt = time() + $data['expiresIn'] - 120;
    }

    public function request($method, $path, $body = null, $retried = false) {
        if (!$this->token || time() > $this->expiresAt) $this->login();
        [$status, $data] = $this->call($method, $this->base . $path,
            ['Authorization: Bearer ' . $this->token, 'Content-Type: application/json'], $body);
        if ($status === 401 && !$retried) { $this->token = null; return $this->request($method, $path, $body, true); }
        if ($status >= 400) throw new Exception("$method $path → $status");
        return $data;
    }
}

$efrat = new Efrat();
$lancamentos = $efrat->request('GET', '/api/financial-entries?page=1&pageSize=50&type=Receber');

TOKEN=$(curl -s -X POST "https://api.efrat.com.br/api/integration/token" \
  -H "Content-Type: application/json" \
  -d "{\"clientId\":\"$EFRAT_CLIENT_ID\",\"clientSecret\":\"$EFRAT_CLIENT_SECRET\"}" | jq -r .accessToken)

curl "https://api.efrat.com.br/api/financial-entries?page=1&pageSize=50&type=Receber" \
  -H "Authorization: Bearer $TOKEN"

// Express
import express from 'express';
import crypto from 'node:crypto';

const app = express();
app.post('/webhooks/efrat', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = 'sha256=' + crypto.createHmac('sha256', process.env.EFRAT_WEBHOOK_SECRET).update(req.body).digest('hex');
  const received = req.get('X-Webhook-Signature') || '';
  const ok = received.length === expected.length && crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));
  if (!ok) return res.sendStatus(401);

  const event = JSON.parse(req.body.toString('utf8'));
  res.sendStatus(200);              // responde já
  processarDepois(event);           // e processa em seguida
});

# Flask
import hmac, hashlib, os
from flask import Flask, request, abort

app = Flask(__name__)

@app.post("/webhooks/efrat")
def efrat_webhook():
    raw = request.get_data()
    expected = "sha256=" + hmac.new(os.environ["EFRAT_WEBHOOK_SECRET"].encode(), raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, request.headers.get("X-Webhook-Signature", "")):
        abort(401)
    event = request.get_json()
    # enfileire event para processar depois
    return "", 200

// ASP.NET Core (minimal API)
app.MapPost("/webhooks/efrat", async (HttpRequest request) =>
{
    using var reader = new StreamReader(request.Body);
    var raw = await reader.ReadToEndAsync();

    var secret = Environment.GetEnvironmentVariable("EFRAT_WEBHOOK_SECRET")!;
    using var hmac = new System.Security.Cryptography.HMACSHA256(System.Text.Encoding.UTF8.GetBytes(secret));
    var expected = "sha256=" + Convert.ToHexStringLower(hmac.ComputeHash(System.Text.Encoding.UTF8.GetBytes(raw)));
    var received = request.Headers["X-Webhook-Signature"].ToString();

    if (!System.Security.Cryptography.CryptographicOperations.FixedTimeEquals(
            System.Text.Encoding.UTF8.GetBytes(expected), System.Text.Encoding.UTF8.GetBytes(received)))
        return Results.Unauthorized();

    var evt = System.Text.Json.JsonDocument.Parse(raw);
    // enfileire evt para processar depois
    return Results.Ok();
});

<?php
$raw = file_get_contents('php://input');
$expected = 'sha256=' . hash_hmac('sha256', $raw, getenv('EFRAT_WEBHOOK_SECRET'));
$received = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';

if (!hash_equals($expected, $received)) {
    http_response_code(401);
    exit;
}

$event = json_decode($raw, true);
// enfileire $event para processar depois
http_response_code(200);

# Conferindo uma assinatura na linha de comando
echo -n '{"event":"CENTRO_CUSTO.Created", ...corpo exato...}' \
  | openssl dgst -sha256 -hmac "SEU_WEBHOOK_SECRET" | sed 's/^.* /sha256=/'