curl -X POST https://api.moaatech.com/api/notify/send \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "email",
    "email": "customer@example.com",
    "subject": "Your order has been confirmed",
    "message": "Hello,\n\nYour order #12345 has been confirmed. Expected delivery within 2 hours.\n\nThank you.",
    "routeType": "transactional"
  }'

// Send via SMS first; fall back to email if SMS fails
const res = await fetch('https://api.moaatech.com/api/notify/send', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    channel: 'sms',
    phone: '+2348031234567',
    sender: 'MTECH',
    email: 'customer@example.com',
    message: 'Your transaction of ₦50,000 was successful.',
    subject: 'Transaction Confirmation',
    routeType: 'transactional',
    fallbackChain: ['email']
  })
});
const data = await res.json();
// data.accepted, data.message_id, data.channel, data.fallback_channels

const res = await fetch('https://api.moaatech.com/api/otp/send', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ phone: '+2348031234567', length: 6 })
});
const { session_id, expires_in } = await res.json();

const res = await fetch('https://api.moaatech.com/api/otp/verify', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    session_id: '550e8400-e29b-41d4-a716-446655440000',
    otp: '847261'
  })
});
const { verified } = await res.json();

const res = await fetch('https://api.moaatech.com/api/wallet/balance', {
  headers: { 'Authorization': `Bearer ${apiKey}` }
});
const { balance, currency } = await res.json();

import hmac, hashlib

def verify_webhook(raw_body: bytes, signature: str, secret: str) -> bool:
    expected = 'sha256=' + hmac.new(
        secret.encode(),
        raw_body,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

# Flask example
@app.route('/webhook', methods=['POST'])
def webhook():
    sig = request.headers.get('X-Moaa-Signature', '')
    if not verify_webhook(request.data, sig, WEBHOOK_SECRET):
        return '', 401
    event = request.get_json()
    # handle event['event'] == 'message.delivered' etc.
    return '', 200