Connect your back end to Reconaxe. Plain JSON, signed webhooks.

export SANAD_URL=http://localhost:8090            # or your test environment
export SANAD_API_KEY=demo-partner-key-not-for-production

curl -X PUT "$SANAD_URL/v1/customers/SME-100245" \
  -H "X-Api-Key: $SANAD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "legal_name_en": "Al-Waha Trading Est.",
    "cr_number": "1010000419",
    "mobile": "+966 11 000 0419",
    "segment": "SMALL",
    "city_code": "RUH",
    "language": "AR",
    "account_status": "A",
    "updated_at": "2026-10-27T09:30:00Z"
  }'

await fetch(`${process.env.SANAD_URL}/v1/customers/SME-100245`, {
  method: 'PUT',
  headers: { 'X-Api-Key': process.env.SANAD_API_KEY, 'Content-Type': 'application/json' },
  body: JSON.stringify({
    legal_name_en: 'Al-Waha Trading Est.',
    cr_number: '1010000419',
    mobile: '+966 11 000 0419',
    segment: 'SMALL', city_code: 'RUH', language: 'AR', account_status: 'A',
    updated_at: '2026-10-27T09:30:00Z',
  }),
});

requests.put(f"{os.environ['SANAD_URL']}/v1/customers/SME-100245",
    headers={"X-Api-Key": os.environ["SANAD_API_KEY"]},
    json={
        "legal_name_en": "Al-Waha Trading Est.",
        "cr_number": "1010000419",
        "mobile": "+966 11 000 0419",
        "segment": "SMALL", "city_code": "RUH", "language": "AR", "account_status": "A",
        "updated_at": "2026-10-27T09:30:00Z",
    }, timeout=15)

{
  "messageId": "9b2f…",
  "status": "delivered",
  "receivedAt": "2026-10-27T10:02:11Z",
  "attempts": 1,
  "case": {
    "caseId": "CS-261027-K2P9",      // show this to the customer
    "customerLinked": true,
    "priority": "p1",             // follows the topic
    "respondBy": "…",             // the customer hears from Reconaxe by then
    "dueAt": "2026-11-03T10:02:11Z"    // 5 SAMA working days
  }
}

import crypto from 'node:crypto';

// rawBody: the exact bytes received, e.g. express.raw({ type: 'application/json' })
// header:  "t=1761559200,v1=5f0c…"
export function isFromSanad(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=')));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest();
  const given = Buffer.from(parts.v1 ?? '', 'hex');
  return given.length === expected.length && crypto.timingSafeEqual(given, expected);
}

import hmac, hashlib, time

# raw_body: the exact bytes received; header: "t=1761559200,v1=5f0c…"
def is_from_sanad(raw_body: bytes, header: str, secret: str) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    t = int(parts.get("t", "0"))
    if not t or abs(time.time() - t) > 300:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts.get("v1", ""))