Public API: integrate with Stripe and Slack.

Authentication

Create an OAuth client at /admin/api-clients. You get client_id and client_secret. Exchange for a 1-hour token:

curl -X POST https://api.orquiva.com/oauth/token \
  -d grant_type=client_credentials \
  -d client_id=$ORQ_ID \
  -d client_secret=$ORQ_SECRET

Recipe 1 — Notify new hires to Slack

Subscribe a webhook to the employee.created event. Every new hire arrives at your endpoint as JSON. Process and post to Slack:

// /api/orquiva-webhook
import { WebClient } from "@slack/web-api";
const slack = new WebClient(process.env.SLACK_TOKEN);

export async function POST(req) {
  const event = await req.json();
  if (event.type !== "employee.created") return new Response("ok");

  await slack.chat.postMessage({
    channel: "#welcomes",
    text: `Welcome ${event.data.fullName} to ${event.data.department}.`,
  });
  return new Response("ok");
}

Recipe 2 — Create Stripe customer on hire

If you use Stripe for reimbursements or benefits, creating a Stripe Customer on each hire removes manual steps:

import Stripe from "stripe";
const stripe = new Stripe(process.env.STRIPE_SECRET);

async function onHire(event) {
  const customer = await stripe.customers.create({
    email: event.data.email,
    name: event.data.fullName,
    metadata: { orquiva_id: event.data.id },
  });
  await fetch(`https://api.orquiva.com/employees/${event.data.id}`, {
    method: "PATCH",
    headers: { Authorization: `Bearer ${token}` },
    body: JSON.stringify({ external_refs: { stripe_id: customer.id } }),
  });
}

Best practices

• Verify the HMAC signature on the webhook (X-Orq-Signature header).
• Idempotency: each event has event.id, ignore duplicates.
• Exponential backoff on 429.
• Don't store the token, request a new one when it expires.