A change in a Buy with Prime resource as a result of certain actions. Examples of actions that trigger events include when a customer requests a return, cancels an item, and so on. The term event also refers to the notifications that you can subscribe to receive when such a change occurs.

Each event has a type. Examples of event types are RETURN_STARTED, ITEM_DELIVERED, and so on. The event type is specified in the detail-type field within the event schema. For a full list of Buy with Prime event types, see Event Types.

An event that contains minimal information. All Buy with Prime events are thin events. After receiving a thin event, you are typically expected to call the Buy with Prime API to request further information. For example, a REFUND_REQUESTED event specifies the order ID and refund ID, but you must make an API call for further information about the refund.

The entity, such as a catalog or order, to which an event pertains. Each Buy with Prime event contains a resources array that contains resource identifiers that you can use to make an API call to retrieve more data.

A serverless event bus that you can configure to receive events from services. In this case, Buy with Prime is the service that publishes the events. With Amazon EventBridge, you set up routing rules to determine where to send the data. For details, see What is Amazon Event Bridge.

An HTTPS request that includes an event to be delivered to a specified HTTPS endpoint.

A URL that is configured to receive webhook HTTPS requests.

An entity in Amazon EventBridge that you can associate with a target to receive and process events. When you subscribe to Buy with Prime events, Buy with Prime creates a partner event source for you, which you can then associate with an event bus. For details about partner event sources, see Receiving events from a SaaS partner with Amazon EventBridge.

The Buy with Prime API refers to the partner event source as an event destination.

A specifically managed selling experience, often a sales channel or store.

In Amazon EventBridge, a type of queue that temporarily stores events and messages that weren’t processed due to system errors. You can optionally create a dead letter queue for Buy with Prime events. For details, see Event retry policy and using dead-letter queues.

"x-amzn-signature": "MGUCMQDjXT1/u2yl2xQyXvWHMpxkD3CmdTZhlNC6FtUM/lBF/fcRGm9WqCx0XqihRtRAw4YCMBDsAiXNFMt9WbSR8tIY+fJq8Cch1SuonYyfc1Kboq4OmbnUOYI2tQq1YvVDugNyWg=="
"x-amzn-kid": "webhooks-7euYmT9H9aEeQ5kYfqrG1IzzT247/iV003IgbXDnPtSpw="

Buy with Prime business products use Amazon EventBridge to deliver these events to your webhook endpoint, so they also include the default headers described in Headers in requests to API destinations in the Amazon EventBridge User Guide.

{
    "idempotencyKey": "MzY0MWI0NjMtNWU2Yi00ZGJlLTk5MmYtMjlhYmUwMmE5YTEyI2NkM2M0MTQ1LWZkZjgtNWQ1Ny03NmMzLTU3YjEyZGZlNzc1NQ=="
    "eventDescriptor": "INVENTORY_CHANGED",
    "resources": ["businessProduct/bp-123/inventory-item/ITEM-ID"],
    "eventId": "cd3c4145-fdf8-5d57-76c3-57b12dfe7755",
    "apiVersion": "2024-01-01",
    "subscriptionId": "3641b463-5e6b-4dbe-992f-29abe02a9a12",
    "eventTime": "2024-07-10T19:51:05Z",
    "data": {}
}

// Required libraries
`import`` java``.``io``.``IOException``;`
`import`` java``.``net``.``URL``;`
import java.nio.charset.StandardCharsets;
import java.security.Signature;
import java.security.interfaces.ECPublicKey;
import com.nimbusds.jose.jwk.JWK;
import com.nimbusds.jose.jwk.ECKey;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;

import java.util.Base64;
import java.util.HashMap;
import java.util.Map;


/**
 * This class provides utility methods for verifying webhook signatures using JSON Web Keys (JWKs).
 */
public class WebhookSignatureVerifierUtility {

    private static final String JWKS_URL = "https://api.buywithprime.amazon.com/jwks.json"; // URL to fetch the JSON Web Key Set (JWKS)
    private static final Map<String, String> kidToPublicKeyMap = new HashMap<>(); // Map to cache public keys, reducing the need for repeated JWKS fetches

    /**
     * Retrieves the JWK (JSON Web Key) for the given key ID (kid) from the JWKS endpoint.
     *
     * @param kid The key ID (kid) of the JWK to retrieve
     * @return The JWK as a JsonNode
     * @throws IOException If an error occurs while fetching the JWK
     */
    private static JsonNode getJwkByKid(String kid) throws IOException {
        ObjectMapper objectMapper = new ObjectMapper();
        JsonNode jwks = objectMapper.readTree(new URL(JWKS_URL));

        JsonNode keys = jwks.get("keys");
        for (JsonNode key : keys) {
            if (kid.equals(key.get("kid").asText())) {
                return key;
            }
        }

        throw new `RuntimeException`("Failed to fetch JWKS");
    }

    /**
     * Verifies the signature of a webhook payload using the provided public key and signature.
     *
     * `@param publicKeyJwk The JWK public key as a JSON string`
     * @param webhookPayload The webhook payload
     * @param webhookSignature The base64-encoded signature of the webhook payload
     * @throws Exception If an error occurs during signature verification
     */
    private static void isWebhookSignatureValid(String `publicKeyJwk`, String webhookPayload, String webhookSignature) throws Exception {
        JWK jwk = JWK.parse(publicKeyJwk);
        ECPublicKey publicKey = ((ECKey) jwk).toECPublicKey();

        // Encode the webhook payload as a byte array
        final byte[] webhookPayloadBytes = webhookPayload.getBytes(StandardCharsets.UTF_8);

        // Base64 decode the webhook signature into a byte array
        final byte[] webhookSignatureBytes = Base64.getDecoder().decode(webhookSignature);

        final Signature signature = Signature.getInstance("SHA384withECDSA");
        signature.initVerify(publicKey);
        signature.update(webhookPayloadBytes);

       if (!signature.verify(webhookSignatureBytes)) {
            throw new RuntimeException("Invalid Signature");
       }
    }

    /**
     * Utility function to verify the signature of a webhook payload.
     *
     * @param kid The key ID (kid) of the JWK
     * @param webhookPayload The webhook payload
     * @param webhookSignature The base64-encoded signature of the webhook payload
     * @throws Exception If an error occurs during signature verification
     */
    public static void verifySignature(String kid, String webhookPayload, String webhookSignature) throws Exception {
        // Fetching of the key from JWKS end-point
        String publicKeyJwk;
        if (kidToPublicKeyMap.containsKey(kid)) {
            publicKeyJwk = kidToPublicKeyMap.get(kid);
            System.out.printf("JWK found for kid: %s is %s%n", kid, publicKeyJwk);
        } else {
            JsonNode jwkNode = getJwkByKid(kid);
            publicKeyJwk = jwkNode.toString();
            kidToPublicKeyMap.put(kid, publicKeyJwk);
            System.out.printf("JWK found for kid: %s is %s%n", kid, publicKeyJwk);
        }
        isWebhookSignatureValid(publicKeyJwk, webhookPayload, webhookSignature);
    }

    public static void main(String[] args) {
        // KeyId
        String kid = "webhooks-7euYmT9H9aEeQ5kYfqrG1IzzT247/iV0IgbXDnPtSpw="; // received in event header x-amzn-kid
        // The received webhook payload/body
        final String webhookPayload = "{\"idempotencyKey\":\"MzE3M2YxNTQtZjc1ZS00ZDcxLTg5ZWQtNjI2NTcwMzc2ODk0IzU2Yjg4ZTRmLTk2NTgtYWRmOC1mMWZhLTQ1MjY2MjA0Mjk4Yg==\",\"eventDescriptor\":\"ITEM_IN_TRANSIT\",\"resources\":[\"businessProduct/bp-test-id/order/order_id/delivery/id\"],\"eventId\":\"56b88e4f-9658-adf8-f1fa-45266204298b\",\"apiVersion\":\"2024-01-01\",\"subscriptionId\":\"3173f154-f75e-4d71-89ed-626570376894\",\"eventTime\":\"2024-07-19T15:48:28Z\",\"data\":{}}";
        // The header received in the webhook from the x-amzn-signature key is base64-encoded
        final String webhookSignature = "MGQCMEzt1Ei6H9qtalFokD7uqTKF43tYGdBev84NNO8jB5+JTsJwN5MUiF66m4lUtn5bkQIwYZKwQhRgPTIGDtiDXsBmQbe0gPJZXdmzq/dJxOM34By+98Yhhpj4wVSTGI7V4YkI";
        try {
            verifySignature(kid, webhookPayload, webhookSignature);
        } catch (Exception e) {
            throw new RuntimeException("Error validating signature", e);
        }
    }
}

// Required libraries
const axios = require('axios');
const crypto = require('crypto');

// URL to fetch the JSON Web Key Set (JWKS)
const JWKS_URL = 'https://api.buywithprime.amazon.com/jwks.json';

// Map to cache public keys, reducing the need for repeated JWKS fetches
const kidToPublicKeyMap = new Map();


/**
 * Fetches the JSON Web Key (JWK) for a given key ID (kid) from the JWKS endpoint.
 *
 * @param {string} kid - The key ID to look for in the JWKS
 * @returns {Promise<Object>} - The JWK object corresponding to the given kid
 * @throws {Error} If no matching key is found or if there's an error fetching the JWKS
 */
async function getJwkByKid(kid) {
    try {
        // Fetch the JWKS from the specified URL
        const response = await axios.get(JWKS_URL);
        const jwks = response.data;

        if (jwks && jwks.keys) {
            return jwks.keys.find(key => key.kid === kid);
        }
        throw new Error('Failed to fetch JWKS');
    } catch (error) {
        console.error('Error fetching JWKS:', error.message);
        throw error;
    }
}

/**
 * Verifies the signature of the webhook payload using a JWK public key.
 *
 * @param {Object} publicKeyJWK - The JWK-formatted public key object.
 * @param {string} webhookPayload - The webhook payload string.
 * @param {string} webhookSignature - The base64-encoded signature string.
 */
function isWebhookSignatureValid(publicKeyJWK, webhookPayload, webhookSignature) {
    const webhookPayloadBuffer = Buffer.from(webhookPayload, 'utf8'); // encode the webhook payload string in binary
    const webhookSignatureBuffer = Buffer.from(webhookSignature, 'base64'); // decode the base64-encoded signature then encode it in binary
    const publicKey = loadPublicKey(publicKeyJWK);

    const verifier = crypto.createVerify('sha384'); // https://nodejs.org/api/crypto.html#cryptocreateverifyalgorithm-options
    verifier.update(webhookPayloadBuffer); // https://nodejs.org/api/crypto.html#verifyupdatedata-inputencoding

    // https://nodejs.org/api/crypto.html#verifyverifyobject-signature-signatureencoding
    if (!verifier.verify(publicKey, webhookSignatureBuffer)) {
        throw new Error(`Invalid Signature`);
    }
}

/**
 * Loads the public key from a JWK-formatted object.
 *
 * @param {Object} publicKeyJWK - The JWK-formatted public key object.
 * @returns {crypto.KeyObject} - The public key object.
 */
function loadPublicKey(publicKeyJWK) {
    return crypto.createPublicKey({key: publicKeyJWK, format: 'jwk'});
}

/**
 * Utility function to verify the signature of a webhook payload.
 *
 * @param {string} kid - The key ID (kid) of the JWK
 * @param {string} webhookPayload - The webhook payload
 * @param {string} webhookSignature - The base64-encoded signature of the webhook payload
 */
async function verifySignature(kid, webhookPayload, webhookSignature) {
    let publicKeyJwk;
    if (kidToPublicKeyMap.has(kid)) {
        publicKeyJwk = kidToPublicKeyMap.get(kid);
        console.log(`JWK found for kid: ${kid} is ${JSON.stringify(publicKeyJwk)}`);
    } else {
        const jwkNode = await getJwkByKid(kid);
        if (jwkNode) {
            publicKeyJwk = jwkNode;
            kidToPublicKeyMap.set(kid, publicKeyJwk);
            console.log(`JWK found for kid: ${kid} is ${JSON.stringify(publicKeyJwk)}`);
        } else {
            throw new Error(`No JWK found for kid: ${kid}`);
        }
    }
    return isWebhookSignatureValid(publicKeyJwk, webhookPayload, webhookSignature);
}

// Main function
async function main() {
    const kid = 'webhooks-7euYmT9H9aEeQ5kYfqrG1IzzT247/iV0IgbXDnPtSpw='; // received in event header x-amzn-kid
    // The received webhook payload/body
    const webhookPayload = '{"idempotencyKey":"MzE3M2YxNTQtZjc1ZS00ZDcxLTg5ZWQtNjI2NTcwMzc2ODk0IzU2Yjg4ZTRmLTk2NTgtYWRmOC1mMWZhLTQ1MjY2MjA0Mjk4Yg==","eventDescriptor":"ITEM_IN_TRANSIT","resources":["businessProduct/bp-test-id/order/order_id/delivery/id"],"eventId":"56b88e4f-9658-adf8-f1fa-45266204298b","apiVersion":"2024-01-01","subscriptionId":"3173f154-f75e-4d71-89ed-626570376894","eventTime":"2024-07-19T15:48:28Z","data":{}}';
    // The header received in the webhook from the x-amzn-signature key is base64-encoded
    const webhookSignature = 'MGQCMEzt1Ei6H9qtalFokD7uqTKF43tYGdBev84NNO8jB5+JTsJwN5MUiF66m4lUtn5bkQIwYZKwQhRgPTIGDtiDXsBmQbe0gPJZXdmzq/dJxOM34By+98Yhhpj4wVSTGI7V4YkI';

    try {
        await verifySignature(kid, webhookPayload, webhookSignature);
    } catch (error) {
        console.error('Error validating signature:', error.message);
    }
}

main();