Reseller API

curl "https://api.esimdistributor.com/api/v1/reseller/catalog?country=FR&sort=price&pageSize=5" \
  -H "X-Api-Key: $ESD_API_KEY"

{
  "items": [{
    "sku": "ESA-FR-3GB-30D",
    "name": "France 3GB 30 Days",
    "slug": "france-3gb-30-days",
    "coverage": { "type": "country", "code": "FR", "name": "France", "countries": ["FR"] },
    "dataType": "fixed",
    "dataGb": 3,
    "dailyDataGb": null,
    "durationDays": 30,
    "speed": "5G",
    "topUpSupported": true,
    "wholesalePrice": 3.15,
    "suggestedRetailPrice": 6.30,
    "currency": "USD",
    "imageUrl": "https://img.esimnest.com/..."
  }],
  "page": 1, "pageSize": 5, "total": 14
}

curl -X POST "https://api.esimdistributor.com/api/v1/reseller/orders" \
  -H "X-Api-Key: $ESD_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: SHOP-1001" \
  -d '{
    "items": [{ "sku": "ESA-FR-3GB-30D", "quantity": 1 }],
    "externalRef": "SHOP-1001",
    "customerEmail": "traveller@example.com",
    "sendEmail": true
  }'

HTTP/1.1 201 Created

{
  "id": "100234",
  "number": "100234",
  "status": "completed",
  "total": 3.15,
  "currency": "USD",
  "createdAt": "2026-10-30T09:12:44Z",
  "externalRef": "SHOP-1001",
  "items": [{ "sku": "ESA-FR-3GB-30D", "name": "France 3GB 30 Days", "quantity": 1, "unitPrice": 3.15 }],
  "esims": [{
    "iccid": "8985...",
    "orderId": "100234",
    "sku": "ESA-FR-3GB-30D",
    "planName": "France 3GB 30 Days",
    "status": "not_installed",
    "lpa": "LPA:1$rsp.example.com$ABCD-1234",
    "smdpAddress": "rsp.example.com",
    "matchingId": "ABCD-1234",
    "qrCodeUrl": "https://api.esimdistributor.com/api/v1/reseller/esims/8985.../qr.png",
    "dataTotalMb": 3072,
    "dataUsedMb": 0,
    "expiresAt": null,
    "activatedAt": null,
    "customerEmail": "traveller@example.com"
  }]
}

import crypto from 'node:crypto';
import express from 'express';

const SECRET = process.env.ESD_WEBHOOK_SECRET; // whsec_... (shown once when you create the webhook)
const TOLERANCE_SECONDS = 5 * 60;

/** True when header = "t=<unix seconds>,v1=<hex HMAC-SHA256(secret, '<t>.<raw body>')>" matches the body. */
export function verifyEsdSignature(rawBody, header, secret = SECRET) {
  if (!header) return false;
  const parts = {};
  for (const part of header.split(',')) {
    const i = part.indexOf('=');
    if (i > 0) parts[part.slice(0, i).trim()] = part.slice(i + 1).trim();
  }
  const t = Number(parts.t);
  if (!Number.isInteger(t) || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - t) > TOLERANCE_SECONDS) return false; // replayed or stale

  const expected = crypto.createHmac('sha256', secret).update(`${parts.t}.`).update(rawBody).digest();
  const given = Buffer.from(parts.v1, 'hex');
  return given.length === expected.length && crypto.timingSafeEqual(given, expected);
}

const app = express();
// Verify the RAW body: parsing and re-serialising JSON changes the bytes and breaks the signature.
app.post('/webhooks/esd', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verifyEsdSignature(req.body, req.get('X-ESD-Signature'))) return res.sendStatus(400);
  const event = JSON.parse(req.body.toString('utf8'));
  // Deduplicate on event.id: a delivery can arrive more than once.
  if (event.type === 'order.completed') {
    // fulfil event.data.order ...
  }
  res.sendStatus(200);
});

using System.Security.Cryptography;
using System.Text;

public static class EsdWebhook
{
    private const int ToleranceSeconds = 5 * 60;

    // True when header = "t=<unix seconds>,v1=<hex HMAC-SHA256(secret, '<t>.<raw body>')>" matches the body.
    public static bool Verify(string rawBody, string? header, string secret)
    {
        if (string.IsNullOrEmpty(header)) return false;
        string? t = null, v1 = null;
        foreach (var part in header.Split(','))
        {
            var i = part.IndexOf('=');
            if (i <= 0) continue;
            var key = part[..i].Trim();
            var value = part[(i + 1)..].Trim();
            if (key == "t") t = value;
            else if (key == "v1") v1 = value;
        }
        if (!long.TryParse(t, out var timestamp) || v1 is null) return false;
        if (Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - timestamp) > ToleranceSeconds) return false;

        var expected = HMACSHA256.HashData(Encoding.UTF8.GetBytes(secret), Encoding.UTF8.GetBytes($"{t}.{rawBody}"));
        byte[] given;
        try { given = Convert.FromHexString(v1); } catch (FormatException) { return false; }
        return CryptographicOperations.FixedTimeEquals(expected, given);
    }
}

// ASP.NET Core minimal API
app.MapPost("/webhooks/esd", async (HttpRequest request, IConfiguration config) =>
{
    using var reader = new StreamReader(request.Body, Encoding.UTF8);
    var rawBody = await reader.ReadToEndAsync();
    if (!EsdWebhook.Verify(rawBody, request.Headers["X-ESD-Signature"], config["Esd:WebhookSecret"]!))
        return Results.BadRequest();
    using var doc = System.Text.Json.JsonDocument.Parse(rawBody);
    // Deduplicate on doc.RootElement.GetProperty("id"): a delivery can arrive more than once.
    return Results.Ok();
});

HTTP/1.1 402 Payment Required

{ "error": { "code": "insufficient_balance", "message": "Balance 12.00 USD is below the order total 18.90 USD." } }

HTTP/1.1 400 Bad Request

{ "error": { "code": "validation_error", "message": "...", "fields": { "email": "..." } } }

POST /your/webhook/endpoint
Content-Type: application/json
X-ESD-Signature: t=1793351564,v1=5f2b0c...e91a

{
  "id": "evt_...",
  "type": "order.completed",
  "createdAt": "2026-10-30T09:12:44Z",
  "data": { "order": { "id": "100234", "status": "completed", "...": "..." } }
}