Cal.com Webhooks + Signbee: Auto-Send NDAs & Waivers on Booking (2026)

import { NextResponse } from "next/server";
import crypto from "crypto";

export async function POST(req: Request) {
  const rawBody = await req.text();
  const signature = req.headers.get("x-cal-signature-256") || "";
  const secret = process.env.CALCOM_WEBHOOK_SECRET!;

  // 1. Verify Cal.com X-Cal-Signature-256 HMAC-SHA256 signature
  const expectedSig = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");

  const sigBuffer = Buffer.from(signature, "utf8");
  const expectedBuffer = Buffer.from(expectedSig, "utf8");

  if (
    sigBuffer.length !== expectedBuffer.length ||
    !crypto.timingSafeEqual(sigBuffer, expectedBuffer)
  ) {
    return NextResponse.json({ error: "Invalid Cal.com signature" }, { status: 401 });
  }

  const body = JSON.parse(rawBody);
  const { triggerEvent, payload } = body;

  if (triggerEvent === "BOOKING_CREATED" || triggerEvent === "BOOKING_REQUESTED") {
    const attendee = payload.attendees?.[0];
    const organizer = payload.organizer;

    if (!attendee?.email) {
      return NextResponse.json({ error: "Missing attendee email" }, { status: 422 });
    }

    // 2. Extract custom Cal.com Booking Question responses
    const companyLegalName =
      payload.responses?.company_legal_name?.value ||
      payload.responses?.company?.value ||
      attendee.name;
    const jobTitle =
      payload.responses?.job_title?.value || "Authorized Representative";
    const discussionTopic =
      payload.responses?.notes?.value || payload.title || "Confidential Commercial Evaluation";

    const bookingUid: string = payload.uid;
    const meetingDate = new Date(payload.startTime).toUTCString();
    const effectiveDate = new Date().toISOString().split("T")[0];

    // 3. Synthesize Mutual Non-Disclosure Agreement in CommonMark Markdown
    const ndaMarkdown = `# Mutual Non-Disclosure & Confidentiality Agreement

**Effective Date:** ${effectiveDate}  
**Cal.com Booking Reference:** ${bookingUid}  
**Scheduled Session:** ${meetingDate}  
**Party A (Host):** Apex Ventures & Advisory LLP (${organizer?.email || "legal@apexventures.vc"})  
**Party B (Participant):** ${companyLegalName}, represented by ${attendee.name}, ${jobTitle} (${attendee.email})

---

## 1. Purpose of Disclosure

In connection with the scheduled briefing on **${meetingDate}** regarding **${discussionTopic}** (the "Permitted Purpose"), each party ("Disclosing Party") may disclose certain non-public technical, financial, strategic, or commercial information ("Confidential Information") to the other party ("Receiving Party").

## 2. Summary of Key Confidentiality Terms

| Parameter | Agreed Legal Standard |
|---|---|
| Agreement Structure | Bilateral / Mutual Protection (Both Parties Protected) |
| Cal.com Session UID | ${bookingUid} |
| Protection Period | Three (3) Years from Effective Date (${effectiveDate}) |
| Standard Exclusions | Public domain, prior lawful possession, independent development |
| Governing Law | State of New York, USA |

## 3. Obligations of the Receiving Party

1. **Strict Non-Disclosure:** Receiving Party shall hold all Confidential Information in strict confidence and shall not disclose it to any third party without prior written consent.
2. **Permitted Internal Access:** Access shall be restricted solely to employees, partners, and professional advisors who have a strict need to know for the Permitted Purpose and are bound by written confidentiality obligations no less protective than this Agreement.
3. **Return or Destruction:** Upon written request by Disclosing Party, Receiving Party shall promptly destroy or return all tangible and electronic copies of Confidential Information.`;

    // 4. Dispatch via Signbee REST API (Party A signed automatically via API key)
    const signbeeRes = await fetch("https://signb.ee/api/v1/send", {
      method: "POST",
      headers: {
        "Authorization": `Bearer ${process.env.SIGNBEE_API_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        title: `Mutual NDA — ${companyLegalName} & Apex Ventures (${effectiveDate})`,
        markdown: ndaMarkdown,
        sender_name: organizer?.name || "Managing Partner — Apex Ventures",
        sender_email: organizer?.email || "legal@apexventures.vc",
        recipient_name: `${attendee.name} (${jobTitle})`,
        recipient_email: attendee.email,
        expires_in_days: 7,
        webhook_url: `${process.env.NEXT_PUBLIC_APP_URL}/api/webhooks/signbee-calcom?booking_uid=${encodeURIComponent(bookingUid)}`,
      }),
    });

    if (!signbeeRes.ok) {
      const errText = await signbeeRes.text();
      return NextResponse.json({ error: errText }, { status: 502 });
    }

    const signbeeData = await signbeeRes.json();

    return NextResponse.json({
      dispatched: true,
      booking_uid: bookingUid,
      signbee_document_id: signbeeData.document_id,
    });
  }

  return NextResponse.json({ received: true });
}

import { NextResponse } from "next/server";

export async function POST(req: Request) {
  const { searchParams } = new URL(req.url);
  const bookingUid = searchParams.get("booking_uid");
  const payload = await req.json();

  if (payload.event === "document.signed" && bookingUid) {
    const { document_id, sha256_hash, signed_at, recipient_email } = payload.data;

    // Call Cal.com API v2 to confirm the pending booking and release video meeting URL
    const calConfirmRes = await fetch(
      `https://api.cal.com/v2/bookings/${bookingUid}/confirm`,
      {
        method: "POST",
        headers: {
          "Authorization": `Bearer ${process.env.CALCOM_API_KEY}`,
          "cal-api-version": "2024-08-13",
          "Content-Type": "application/json",
        },
        body: JSON.stringify({
          reason: `Mutual NDA cryptographically executed via Signbee (ID: ${document_id}, SHA-256: ${sha256_hash})`,
        }),
      }
    );

    if (!calConfirmRes.ok) {
      const errText = await calConfirmRes.text();
      console.error(`Failed to confirm Cal.com booking ${bookingUid}: ${errText}`);
      return NextResponse.json({ error: errText }, { status: 500 });
    }

    console.log(
      `[Cal.com + Signbee] Confirmed booking ${bookingUid} for ${recipient_email} at ${signed_at}`
    );

    return NextResponse.json({
      confirmed: true,
      booking_uid: bookingUid,
      signbee_document_id: document_id,
      sha256_hash,
    });
  }

  return NextResponse.json({ received: true });
}

export function buildClinicalConsentMarkdown(params: {
  patientName: string;
  patientEmail: string;
  dateOfBirth: string;
  declaredAllergies: string;
  practitionerName: string;
  appointmentTime: string;
  bookingUid: string;
}) {
  return `# Patient Informed Consent & Telehealth Privacy Waiver

**Appointment Reference:** ${params.bookingUid}  
**Scheduled Consultation:** ${params.appointmentTime}  
**Attending Practitioner:** ${params.practitionerName}

## 1. Patient Intake Summary

| Field | Patient Declared Value |
|---|---|
| Full Legal Name | ${params.patientName} |
| Verified Email | ${params.patientEmail} |
| Date of Birth | ${params.dateOfBirth} |
| Disclosed Allergies / Contraindications | ${params.declaredAllergies || "None Disclosed"} |

## 2. Informed Consent for Consultation & Treatment

I, **${params.patientName}**, hereby voluntarily consent to diagnostic assessment and clinical consultation provided by **${params.practitionerName}**. I confirm that the medical history and allergy disclosures listed in Section 1 are accurate and complete to the best of my knowledge.

## 3. Electronic Signature & Cryptographic Audit Acknowlegment

By executing this document electronically via Signbee, I agree that my electronic signature carries the same legal validity and enforceability as a handwritten signature under the US ESIGN Act, UETA, and UK/EU eIDAS regulations.`;
}