YUBASync Link

$ curl -X POST https://suite.yubasync.com/api/login/authenticate \
     -H 'Content-Type: application/json' \
     -d '{"username":"acme_prod","password":"••••••••••"}'

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0eXAiOiJiYXQtYXBpIiwi…"
}

# El token dura 90 días; renovarlo es volver a llamar este endpoint.
# Máximo 10 intentos por minuto. Usuario inexistente y clave incorrecta
# devuelven exactamente la misma respuesta — a propósito.
# Revocar la credencial corta el acceso YA, sin esperar al vencimiento.

$ curl -G https://suite.yubasync.com/api/v2/salesOrder \
     -H 'Authorization: Bearer $TOKEN' \
     -d page=1 -d max=100 \
     -d start=01/05/2026 -d end=31/05/2026 \
     -d filterWithDate=lastUpdated

{
  "data": [
    {
      "id": "SO-2026-004182",
      "customer": "900123456",
      "type": "Wholesale order",
      "dateCreated": "2026-05-14T09:22:31.000Z",
      "scheduledDateForDelivery": "2026-05-16T00:00:00.000Z",
      "priceList": "MAY-01",
      "totalBeforeTax": 1840000,
      "totalTax": 349600,
      "totalSales": 2189600,
      "billable": true,
      "billed": false,
      "exported": true,
      "externalId": "P0034182",
      "networkSignalQuality": "POOR",
      "errorMessageFromIntegration": null,
      "items": [
        { "product": "ARR-500", "quantity": 40, "price": 24500, "total": 980000 },
        { "product": "PAN-024", "quantity": 50, "price": 17200, "total": 860000 }
      ]
    }
  ],
  "pagination": { "page": 1, "pageSize": 100, "totalPages": 7, "totalRecords": 683 }
}

$ curl -i https://suite.yubasync.com/api/v2/items

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="bat-api"
Content-Type: application/json; charset=utf-8
Cache-Control: no-store

{
  "errorCode": "INVALID_TOKEN",
  "message": "Missing bearer token",
  "details": "Header Authorization: Bearer {TOKEN} is required"
}

# Códigos estables: INVALID_TOKEN · TOKEN_EXPIRED · ACCESS_DENIED
#                  INVALID_CREDENTIALS · RATE_LIMIT_EXCEEDED
# El 429 siempre trae Retry-After: 60 — no hay que adivinar el backoff.
# `details` se omite cuando no aporta; nunca llega como null.

X-Yuba-Event:       shipment.delivered
X-Yuba-Delivery-Id: 6f1c1a9e-4b02-4f4e-9a31-2c0e7d5a11b8
X-Yuba-Webhook-Id:  0b2d94c7-1f88-4a55-bb10-8e6f0a7c3d21
X-Yuba-Signature:   t=1779023011,v1=9f3c…c1
User-Agent:         YubaWebhook/1.0

{ "id": "6f1c1a9e-…", "event": "shipment.delivered",
  "ts": "2026-05-18T14:23:31.482Z", "data": { … } }


// Verificación del lado del receptor — la firma se calcula sobre `${t}.${body}`
import crypto from "node:crypto";

export function verificar(rawBody, header, secret) {
  const { t, v1 } = Object.fromEntries(header.split(",").map(p => p.split("=")));

  // Anti-replay: fuera de ±300 s se descarta aunque la firma cuadre.
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;

  const esperado = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");

  // Comparación en tiempo constante: un `===` filtra información por timing.
  return crypto.timingSafeEqual(Buffer.from(esperado), Buffer.from(v1));
}