API hujjatlari

Authorization: Bearer rz_live_…

curl https://<your-domain>/api/v1/verify \
  -H "Authorization: Bearer $RZ_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "phone": "+998901234567",
    "channel": "sms",
    "purpose": "promo"
  }'

curl https://<your-domain>/api/v1/verify/batch \
  -H "Authorization: Bearer $RZ_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "items": [
    { "phone": "+998901234567", "channel": "sms" },
    { "phone": "+998931112233", "channel": "sms" },
    { "phone": "12345", "channel": "sms" }
  ] }'

{
  "results": [
    { "phone": "+998901234567", "allowed": true, "reason": null, "certificate": "cert_01JB…", "retry_after": null, "checked_at": "…", "request_id": "req_…" },
    { "phone": "+998931112233", "allowed": false, "reason": "NO_CONSENT", "certificate": null, "retry_after": null, "checked_at": "…", "request_id": "req_…" },
    { "phone": "12345", "allowed": false, "reason": null, "certificate": null, "retry_after": null, "checked_at": "…", "request_id": "req_…",
      "error": { "code": "invalid_phone", "message": "Not a valid Uzbek number. Use +998 and 9 digits." } }
  ]
}

curl https://<your-domain>/api/v1/consents/otp \
  -H "Authorization: Bearer $RZ_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "template": "promo_sms",
    "phone": "+998901234567",
    "channels": ["sms"],
    "locale": "uz",
    "evidence": {
      "events": [
        { "type": "page_opened", "at": "2026-11-02T10:14:31.020Z" },
        { "type": "channel_ticked:sms", "at": "2026-11-02T10:14:39.551Z" },
        { "type": "agree_tapped", "at": "2026-11-02T10:14:42.108Z" }
      ],
      "pageUrl": "https://shop.example.uz/signup"
    },
    "ip": "203.0.113.24",
    "user_agent": "Mozilla/5.0 …"
  }'

{ "session": "cs_01JB3P2K…", "expires_at": "2026-11-02T10:19:42.300Z", "test_code": "481902" }

curl https://<your-domain>/api/v1/consents/otp/cs_01JB3P2K…/confirm \
  -H "Authorization: Bearer $RZ_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "code": "481902" }'

{ "certificate": "cert_01JB3P3M…", "verify_url": "https://<your-domain>/cert/cert_01JB3P3M…" }

curl -X POST https://<your-domain>/api/v1/forms/claim \
  -H "Authorization: Bearer $RZ_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "cert_url": "<value of rozilik_cert_url from the form>",
    "phone": "+998901234567",
    "template": "promo_sms"
  }'

// In your form handler, after you save the lead
const res = await fetch('https://<your-domain>/api/v1/forms/claim', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.RZ_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    cert_url: req.body.rozilik_cert_url,
    phone: req.body.phone,
    template: 'promo_sms',
    reference: lead.id, // optional, kept in the audit log
  }),
});
const claim = await res.json();
if (!res.ok) throw new Error(claim.error.code); // e.g. opt_in_not_ticked
await saveCertificate(lead.id, claim.certificate);

{
  "certificate": "cert_01JB3M6Q8Z4X7N2K5R9T",
  "verify_url": "https://<your-domain>/cert/cert_01JB3M6Q8Z4X7N2K5R9T",
  "form_session": "fs_01JB3M5V…",
  "test": false,
  "checks": {
    "phone_matched": true,
    "consent_language": { "found": true, "locale": "uz" },
    "opt_in": "user_ticked",
    "submitted": true
  },
  "page_url": "https://shop.example.uz/signup",
  "recorded_at": "2026-11-02T10:14:31.020Z",
  "duration_ms": 48210
}

{
  "id": "cert_01JB3M6Q8Z4X7N2K5R9T",
  "status": "active",
  "issuedAt": "2026-11-01T04:41:12.000Z",
  "revokedAt": null,
  "sender": { "legalName": "Savdo Market MChJ", "tin": "301234567" },
  "phoneMasked": "+998 •• ••• •• 67",
  "channels": ["sms"],
  "purposes": ["promo"],
  "source": "hosted_page",
  "locale": "uz",
  "text": "Men … roziman …",
  "templateVersion": 3,
  "payload": { "v": 1, "id": "cert_01JB3M6Q8Z4X7N2K5R9T", "issuer": "RozilikID", … },
  "payloadSha256": "9f2c…",
  "signature": "MEUCIQ…",
  "keyId": "rz-2026-10",
  "alg": "ES256",
  "test": false
}

curl "https://<your-domain>/api/v1/customers?phone=%2B998901234567" \
  -H "Authorization: Bearer $RZ_KEY"

{
  "phone": "+998901234567",
  "consents": [
    {
      "certificate": "cert_01JB3M6Q8Z4X7N2K5R9T",
      "status": "active",
      "channels": ["sms", "telegram"],
      "template": "promo_sms",
      "consented_at": "2026-11-01T04:41:12.000Z",
      "expires_at": "2028-11-01T04:41:12.000Z"
    }
  ]
}

curl https://<your-domain>/api/v1/revocations \
  -H "Authorization: Bearer $RZ_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "phone": "+998901234567", "via": "call_center" }'

{ "revoked": 1 }

curl https://<your-domain>/api/v1/campaigns/preflight \
  -H "Authorization: Bearer $RZ_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "phones": ["+998901234567", "+998931112233", "+998977654321"],
    "channel": "sms",
    "purpose": "promo",
    "send_at": "2026-11-03T10:00:00+05:00"
  }'

{
  "total": 3,
  "allowed": ["+998901234567"],
  "removed": [
    { "phone": "+998931112233", "reason": "NO_CONSENT" },
    { "phone": "+998977654321", "reason": "REVOKED" }
  ]
}

{
  "id": "evt_01JB3Q8W…",
  "type": "consent.revoked",
  "created_at": "2026-11-02T12:03:44.120Z",
  "livemode": true,
  "data": {
    "certificate": "cert_01JB3M6Q8Z4X7N2K5R9T",
    "phone_last4": "4567",
    "via": "telegram",
    "channels": ["sms"],
    "revoked_at": "2026-11-02T12:03:44.090Z"
  }
}

import crypto from 'node:crypto';
import express from 'express';

const app = express();

app.post('/webhooks/rozilik', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('X-Rozilik-Signature') ?? '';
  const parts = Object.fromEntries(header.split(',').map((kv) => kv.split('=')));
  const t = Number(parts.t);
  const expected = crypto
    .createHmac('sha256', process.env.RZ_WEBHOOK_SECRET)
    .update(`${t}.${req.body}`)            // req.body is the raw Buffer
    .digest('hex');

  const valid =
    typeof parts.v1 === 'string' &&
    parts.v1.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(parts.v1), Buffer.from(expected)) &&
    Math.abs(Date.now() / 1000 - t) < 300;    // reject replays older than 5 minutes
  if (!valid) return res.status(400).send('invalid signature');

  const event = JSON.parse(req.body.toString('utf8'));
  if (event.type === 'consent.revoked') {
    // Stop messaging this customer now: event.data.certificate
  }
  res.sendStatus(200);
});

import { createHash, webcrypto } from 'node:crypto';

const canonicalize = (v) =>
  v === null || typeof v !== 'object'
    ? JSON.stringify(v)
    : Array.isArray(v)
      ? '[' + v.map((x) => (x === undefined ? 'null' : canonicalize(x))).join(',') + ']'
      : '{' + Object.keys(v).filter((k) => v[k] !== undefined).sort()
          .map((k) => JSON.stringify(k) + ':' + canonicalize(v[k])).join(',') + '}';

const id = 'cert_01JB3M6Q8Z4X7N2K5R9T';
const cert = await (await fetch(`https://<your-domain>/api/public/certificates/${id}`)).json();
const { keys } = await (await fetch('https://<your-domain>/.well-known/jwks.json')).json();
const jwk = keys.find((k) => k.kid === cert.keyId);

const bytes = new TextEncoder().encode(canonicalize(cert.payload));
const hashOk = createHash('sha256').update(bytes).digest('hex') === cert.payloadSha256;

const key = await webcrypto.subtle.importKey('jwk', jwk, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
const signatureOk = await webcrypto.subtle.verify(
  { name: 'ECDSA', hash: 'SHA-256' }, key, Buffer.from(cert.signature, 'base64url'), bytes,
);
console.log({ hashOk, signatureOk });

HTTP/1.1 403 Forbidden

{
  "error": {
    "code": "forbidden",
    "message": "This key lacks the \"verify\" permission"
  }
}