Every lead, from every channel, in seconds.

curl -X POST https://app.subulagency.com/api/v1/leads \
  -H "Authorization: Bearer $WASLA_TOKEN" \
  -H "Idempotency-Key: 6f1c2e7a-lead-0412" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Omar Khaled",
    "phone": "+201002344567",
    "source": "website",
    "campaign": "spring-launch",
    "fields": { "budget_egp": 4500000, "area": "new-cairo" }
  }'

# 201 Created
# { "id": "lead_8KQ2", "assigned_to": "usr_nour", "duplicate": false }

POST https://your-app.example.com/hooks/wasla
X-Wasla-Event: lead.assigned
X-Wasla-Signature: t=1760090523,v1=5d2c…a91f

{
  "id": "evt_31Hx",
  "type": "lead.assigned",
  "created_at": "2026-10-10T10:42:07Z",
  "data": {
    "lead_id": "lead_8KQ2",
    "source": "meta_lead_ads",
    "campaign": { "id": "238491", "name": "Spring Launch" },
    "adset_id": "238492",
    "ad_id": "238497",
    "assigned_to": { "id": "usr_nour", "name": "Nour A." }
  }
}

import crypto from "node:crypto";

export function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(
    header.split(",").map((p) => p.split("="))
  );
  const expected = crypto
    .createHmac("sha256", secret)
    .update(parts.t + "." + rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(parts.v1)
  );
}