Copy, paste, send

import os
import time
import requests

API = "https://api.botpulsar.com/api/v1/partner-api/workspace"
HEADERS = {"Authorization": f"ApiKey {os.environ['BOTPULSAR_API_KEY']}"}


def send_template(to, name, params, idempotency_key, language="en"):
    body = {
        "to": to,
        "template": {"name": name, "language": language, "params": params},
        "idempotency_key": idempotency_key,
    }
    for attempt in range(4):
        r = requests.post(f"{API}/messages/", headers=HEADERS, json=body, timeout=15)
        if r.status_code == 429:  # rate limited: wait as told, then retry the SAME key
            time.sleep(int(r.headers.get("Retry-After", 5)))
            continue
        if r.status_code >= 500:  # transient: back off and retry the SAME key
            time.sleep(2 ** attempt)
            continue
        if r.status_code >= 400:  # our mistake or a business rule: do not retry blindly
            raise RuntimeError(r.json()["error"])  # e.g. template_not_approved
        return r.json()  # {"id": ..., "delivery_status": "queued", ...}
    raise RuntimeError("BotPulsar unavailable after retries")


message = send_template("+919812345678", "fee_due", ["Ada", "₹4,500", "15 Oct"], "fee-STU1042-2026-10")
print(message["id"], message["delivery_status"])

const API = "https://api.botpulsar.com/api/v1/partner-api/workspace";

async function sendTemplate({ to, name, params, idempotencyKey, language = "en" }) {
  for (let attempt = 0; attempt < 4; attempt++) {
    const res = await fetch(`${API}/messages/`, {
      method: "POST",
      headers: {
        Authorization: `ApiKey ${process.env.BOTPULSAR_API_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        to,
        template: { name, language, params },
        idempotency_key: idempotencyKey,
      }),
    });
    if (res.status === 429) {
      await new Promise((r) => setTimeout(r, Number(res.headers.get("Retry-After") || 5) * 1000));
      continue;
    }
    if (res.status >= 500) {
      await new Promise((r) => setTimeout(r, 2 ** attempt * 1000));
      continue;
    }
    const data = await res.json();
    if (!res.ok) throw new Error(JSON.stringify(data.error)); // e.g. template_not_approved
    return data; // { id, delivery_status: "queued", ... }
  }
  throw new Error("BotPulsar unavailable after retries");
}

sendTemplate({
  to: "+919812345678",
  name: "fee_due",
  params: ["Ada", "₹4,500", "15 Oct"],
  idempotencyKey: "fee-STU1042-2026-10",
}).then(console.log);

<?php
$payload = json_encode([
    "to" => "+919812345678",
    "template" => ["name" => "fee_due", "language" => "en", "params" => ["Ada", "₹4,500", "15 Oct"]],
    "idempotency_key" => "fee-STU1042-2026-10",
]);

$ch = curl_init("https://api.botpulsar.com/api/v1/partner-api/workspace/messages/");
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => $payload,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 15,
    CURLOPT_HTTPHEADER => [
        "Authorization: ApiKey " . getenv("BOTPULSAR_API_KEY"),
        "Content-Type: application/json",
    ],
]);
$body = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($status >= 400) {
    throw new RuntimeException(json_encode($body["error"])); // e.g. template_not_approved
}
echo $body["id"] . " " . $body["delivery_status"];

import hashlib
import hmac
import os
import time

import requests
from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["BOTPULSAR_WEBHOOK_SECRET"]  # whsec_...
API_KEY = os.environ["BOTPULSAR_API_KEY"]
seen = set()  # use Redis or a database table in production


def valid(raw: bytes, timestamp: str, header: str) -> bool:
    if abs(time.time() - int(timestamp)) > 300:
        return False
    expected = hmac.new(SECRET.encode(), f"{timestamp}.".encode() + raw, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header.removeprefix("v1="))


@app.post("/hooks/botpulsar")
def botpulsar():
    raw = request.get_data()  # the exact bytes, before any JSON parsing
    if not valid(raw, request.headers.get("X-Botpulsar-Timestamp", "0"),
                 request.headers.get("X-Botpulsar-Signature", "")):
        abort(401)

    delivery_id = request.headers["X-Botpulsar-Delivery"]
    if delivery_id in seen:  # retries reuse the same id
        return "", 200
    seen.add(delivery_id)

    event = request.get_json()
    if event["type"] == "message.received":
        r = requests.get(
            f"https://api.botpulsar.com/api/v1/partner-api/workspace/messages/{event['data']['message_id']}/",
            headers={"Authorization": f"ApiKey {API_KEY}"},
            timeout=10,
        )
        msg = r.json()
        print("reply from", msg["from"], ":", msg["text"])  # queue real work instead
    elif event["type"] == "message.delivery_status.changed":
        print("status update", event["data"])
    return "", 200

const crypto = require("crypto");
const express = require("express");
const app = express();
const seen = new Set(); // use Redis or a database table in production

// IMPORTANT: capture the raw body. Do not use express.json() on this route.
app.post("/hooks/botpulsar", express.raw({ type: "application/json" }), (req, res) => {
  const timestamp = req.get("X-Botpulsar-Timestamp") || "0";
  const header = (req.get("X-Botpulsar-Signature") || "").replace(/^v1=/, "");
  const expected = crypto
    .createHmac("sha256", process.env.BOTPULSAR_WEBHOOK_SECRET)
    .update(`${timestamp}.`)
    .update(req.body) // Buffer
    .digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;
  const ok =
    fresh &&
    header.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(header));
  if (!ok) return res.sendStatus(401);

  const deliveryId = req.get("X-Botpulsar-Delivery");
  if (seen.has(deliveryId)) return res.sendStatus(200);
  seen.add(deliveryId);

  const event = JSON.parse(req.body.toString("utf8"));
  console.log(event.type, event.data); // hand off to a queue, then respond
  res.sendStatus(200);
});

app.listen(3000);

<?php
$raw = file_get_contents("php://input"); // exact bytes
$timestamp = $_SERVER["HTTP_X_BOTPULSAR_TIMESTAMP"] ?? "0";
$header = preg_replace('/^v1=/', '', $_SERVER["HTTP_X_BOTPULSAR_SIGNATURE"] ?? "");
$expected = hash_hmac("sha256", $timestamp . "." . $raw, getenv("BOTPULSAR_WEBHOOK_SECRET"));

if (abs(time() - (int) $timestamp) > 300 || !hash_equals($expected, $header)) {
    http_response_code(401);
    exit;
}

$event = json_decode($raw, true);
// De-duplicate on $_SERVER["HTTP_X_BOTPULSAR_DELIVERY"], then queue the work.
error_log($event["type"]);
http_response_code(200);