Troubleshooting Guide

// Correct API call with authentication headers
const response = await fetch(
  'https://orchestrate.corridorly.com/symphony/execute/marketplace/smart_global_router',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-Api-Key': process.env.CORRIDORLY_API_KEY, // Required
      'X-Tenant-Id': process.env.CORRIDORLY_TENANT_ID, // Required
    },
    body: JSON.stringify({ context: { /* ... */ } }),
  }
);

// Correct request structure
{
  "context": {
    "amount": 9900,
    "currency": "GBP",
    "customer": {
      "id": "cust_123",
      "email": "customer@example.com",
      "country": "GB"
    }
  }
}

// INCORRECT - missing context wrapper
{
  "amount": 9900,
  "currency": "GBP"
}

// Marketplace symphony (like smart_global_router)
POST /symphony/execute/marketplace/smart_global_router

// Custom instance symphony
POST /symphony/execute/instance/your_custom_symphony_id

// Example error response
{
  "executionId": "exec_abc123",
  "symphonyId": "smart_global_router",
  "status": "partial",
  "stages": [
    {
      "stageNumber": 1,
      "recipeId": "payment_routing",
      "status": "complete",
      "executionTimeMs": 234
    },
    {
      "stageNumber": 2,
      "recipeId": "fraud_check",
      "status": "failed",
      "error": {
        "code": "EXECUTION_ERROR",
        "message": "Fraud check service unavailable"
      },
      "executionTimeMs": 102
    }
  ]
}

// Correct webhook verification
import crypto from 'crypto';

function verifyWebhook(payload, signature, timestamp, secret) {
  // 1. Check timestamp (must be within 5 minutes)
  const currentTime = Date.now();
  const requestTime = parseInt(timestamp, 10);
  if (Math.abs(currentTime - requestTime) > 300000) {
    return false; // Timestamp too old/new
  }

  // 2. Create signed payload
  const signedPayload = `${timestamp}.${payload}`;

  // 3. Compute expected signature
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedPayload, 'utf8')
    .digest('hex');

  // 4. Compare signatures (timing-safe)
  return crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expectedSignature, 'hex')
  );
}

// In your webhook handler
app.post('/webhooks/corridorly', (req, res) => {
  const signature = req.headers['x-corridorly-signature'];
  const timestamp = req.headers['x-corridorly-timestamp'];
  const payload = JSON.stringify(req.body); // Use raw body!

  if (!verifyWebhook(payload, signature, timestamp, WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  // Process webhook...
  res.status(200).send('OK');
});

// Good: Fast response
app.post('/webhooks/corridorly', async (req, res) => {
  // 1. Verify signature
  if (!verifyWebhook(...)) {
    return res.status(401).send('Invalid signature');
  }

  // 2. Acknowledge immediately
  res.status(200).send('OK');

  // 3. Process asynchronously
  processWebhookAsync(req.body).catch(err => {
    console.error('Webhook processing error:', err);
  });
});

// Bad: Slow response
app.post('/webhooks/corridorly', async (req, res) => {
  await verifySignature(...);
  await updateDatabase(...); // Slow!
  await sendEmail(...); // Slow!
  await callExternalAPI(...); // Slow!
  res.status(200).send('OK'); // Too late!
});

// Environment configuration
const API_URLS = {
  sandbox: 'https://orchestrate.sandbox.corridorly.com',
  production: 'https://orchestrate.corridorly.com',
};

const CORRIDOR_ENV = process.env.CORRIDORLY_ENV || 'production';
const API_KEY = process.env[`CORRIDORLY_API_KEY_${CORRIDOR_ENV.toUpperCase()}`];
const TENANT_ID = process.env[`CORRIDORLY_TENANT_ID_${CORRIDOR_ENV.toUpperCase()}`];

const baseUrl = API_URLS[CORRIDOR_ENV];

// CORRECT: Backend endpoint
// server.js (Node.js backend)
app.post('/api/process-payment', async (req, res) => {
  const response = await fetch(
    'https://orchestrate.corridorly.com/symphony/execute/marketplace/smart_global_router',
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-Api-Key': process.env.CORRIDORLY_API_KEY, // Secure!
        'X-Tenant-Id': process.env.CORRIDORLY_TENANT_ID,
      },
      body: JSON.stringify({ context: req.body }),
    }
  );

  const result = await response.json();
  res.json(result);
});

// WRONG: Direct browser call
// frontend.js - DO NOT DO THIS!
fetch('https://orchestrate.corridorly.com/...', {
  headers: {
    'X-Api-Key': 'your_key', // EXPOSED TO USERS!
  }
});