API & Webhooks für Anbieter

POST <Ihre URL>
Content-Type: application/json
User-Agent: parkradar24-webhook/1.0
X-Parkradar-Event: booking.created
X-Parkradar-Delivery: <uuid der Lieferung>
X-Parkradar-Timestamp: <unix-sekunden>
X-Parkradar-Signature: sha256=<hex>

{
  "event": "booking.created",
  "sent_at": "2026-05-02T10:30:00.000Z",
  "data": {
    "booking": {
      "id": "1d1e9f02-…",
      "booking_number": "PP-A1B2C3D4",
      "status": "confirmed",
      "payment_status": "paid",
      "arrival_at": "2026-06-01T05:30:00.000Z",
      "departure_at": "2026-06-08T22:15:00.000Z",
      "passenger_count": 2,
      "flight_number": "LH438",
      "service_package": "smart",
      "locale": "de",
      "created_at": "2026-05-02T10:29:58.000Z",
      "updated_at": "2026-05-02T10:29:58.000Z",
      "cancelled_at": null,
      "cancellation_reason": null,
      "notes": null
    },
    "customer": {
      "name": "Max Mustermann",
      "email": "max@example.com",
      "phone": "+49 151 1234567"
    },
    "vehicle": {
      "make": "VW",
      "model": "Golf",
      "license_plate": "F-MM 1234"
    },
    "pricing": {
      "subtotal": 89,
      "discount_amount": 0,
      "surcharges_total": 5,
      "surcharges_breakdown": [
        {
          "key": "night",
          "label": "Nachtzuschlag",
          "amount": 5
        }
      ],
      "service_package_price": 6.99,
      "reservation_fee": 0.99,
      "total_price": 101.98,
      "provider_payout_amount": 75.2,
      "currency": "EUR"
    },
    "offer": {
      "id": "…",
      "title": "Shuttle-Parkplatz",
      "type": "shuttle"
    },
    "airport": {
      "id": "…",
      "code": "FRA",
      "city": "Frankfurt",
      "name": "Frankfurt Airport"
    },
    "provider": {
      "id": "…"
    }
  }
}

// Node.js Beispiel — Express
import express from "express";
import crypto from "crypto";
const app = express();
const SECRET = process.env.PARKRADAR_WEBHOOK_SECRET;

app.post("/parkradar/webhook",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const sig = (req.header("X-Parkradar-Signature") || "").replace(/^sha256=/, "");
    const ts = req.header("X-Parkradar-Timestamp") || "";
    const body = req.body.toString("utf8");

    // Replay-Schutz: max. 5 Minuten Drift
    if (Math.abs(Date.now()/1000 - Number(ts)) > 300) return res.sendStatus(401);

    const expected = crypto.createHmac("sha256", SECRET)
      .update(`${ts}.${body}`).digest("hex");

    if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)))
      return res.sendStatus(401);

    const event = JSON.parse(body);
    // -> in Parkmanagement-Software übernehmen
    res.sendStatus(200);
});

<?php
$secret = getenv('PARKRADAR_WEBHOOK_SECRET');
$body = file_get_contents('php://input');
$sig = str_replace('sha256=', '', $_SERVER['HTTP_X_PARKRADAR_SIGNATURE'] ?? '');
$ts  = $_SERVER['HTTP_X_PARKRADAR_TIMESTAMP'] ?? '';

if (abs(time() - intval($ts)) > 300) { http_response_code(401); exit; }

$expected = hash_hmac('sha256', $ts . '.' . $body, $secret);
if (!hash_equals($expected, $sig)) { http_response_code(401); exit; }

$event = json_decode($body, true);
// -> in Parkmanagement-Software übernehmen
http_response_code(200);