Paramount E-Course Platform API

# Fetch the public course catalogue
curl -X GET "https://course.paramountmart.shop/api/courses" \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Accept: application/json"

const PECS_API = 'https://course.paramountmart.shop/api';
const API_KEY  = 'YOUR_API_KEY';

async function getCourses() {
  const res = await fetch(`${PECS_API}/courses`, {
    headers: {
      'X-API-Key': API_KEY,
      'Accept': 'application/json'
    }
  });
  const { data } = await res.json();
  return data.courses; // Array of course objects
}

// Example response:
// [{ id: 1, title: "Web Dev Bootcamp", category: "Technology",
//    level: "Intermediate", duration: "40h", rating: 4.9 }]

<?php
$api_key = 'YOUR_API_KEY';
$base    = 'https://course.paramountmart.shop/api';

function pecs_get(string $endpoint): array {
    global $api_key, $base;
    $ch = curl_init("$base/$endpoint");
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER     => [
            "X-API-Key: $api_key",
            'Accept: application/json'
        ]
    ]);
    $body = curl_exec($ch);
    curl_close($ch);
    return json_decode($body, true)['data'] ?? [];
}

$courses = pecs_get('courses')['courses'];
foreach ($courses as $c) {
    echo $c['title'] . " — " . $c['rating'] . "\n";
}

curl -X POST "https://course.paramountmart.shop/api/connect/webhooks" \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://yoursite.com/pecs-webhook",
    "events": ["course.completed", "certificate.issued", "webinar.started"],
    "secret": "your_webhook_signing_secret"
  }'

{
  "event": "course.completed",
  "timestamp": "2025-01-15T10:34:22Z",
  "webhook_id": "wh_evt_abc123xyz",
  "data": {
    "user_id": 42,
    "user_name": "Adaeze Okonkwo",
    "user_email": "adaeze@example.com",
    "external_user_id": "your-user-ref-456",
    "course_id": 1,
    "course_title": "Digital Marketing Mastery",
    "completed_at": "2025-01-15T10:34:21Z",
    "certificate_id": "PECS-2025-001234"
  }
}

<?php
// Your webhook handler (e.g. /pecs-webhook.php)

$payload   = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_PECS_SIGNATURE'] ?? '';
$secret    = 'YOUR_WEBHOOK_SIGNING_SECRET';

// Compute expected signature
$expected = 'sha256=' . hash_hmac('sha256', $payload, $secret);

// Constant-time comparison to prevent timing attacks
if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($payload, true);

switch ($event['event']) {
    case 'course.completed':
        // Award your own badge or update your CRM
        handle_completion($event['data']);
        break;
    case 'certificate.issued':
        // Notify the user via your own system
        notify_certificate($event['data']);
        break;
    case 'webinar.started':
        // Show "LIVE NOW" banner on your site
        broadcast_live_notification($event['data']);
        break;
}

http_response_code(200);
echo json_encode(['received' => true]);

const crypto = require('crypto');

function verifyEcosWebhook(rawBody, signature, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  // Constant-time comparison
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  );
}

// Express.js handler
app.post('/pecs-webhook', express.raw({ type: '*/*' }), (req, res) => {
  const sig    = req.headers['x-pecs-signature'];
  const secret = process.env.PECS_WEBHOOK_SECRET;

  if (!verifyEcosWebhook(req.body, sig, secret)) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body);
  console.log('Event received:', event.event, event.data);
  res.json({ received: true });
});