Guide: Bot Interactive Quickstart — от нуля до первой кнопки#

export BASE='https://api.partyflow.ru'
export TOKEN='fri_bot_...'
export CHANNEL_ID='<uuid-канала>'

curl -X PATCH "$BASE/api/v1/bot/interactive_config" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"callback_url": "https://your-bot.example.com/partyflow/interactive"}'

{
  "ok": true,
  "callback_url": "https://your-bot.example.com/partyflow/interactive",
  "signing_secret": "<hex-secret>"
}

export BUTTONS_SECRET='<hex-secret>'

curl "$BASE/api/v1/bot/interactive_config" -H "Authorization: Bearer $TOKEN"
# {"ok": true, "enabled": true, "callback_url": "https://..."}

curl -X PATCH "$BASE/api/v1/bot/me" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"event_delivery_mode": "poll"}'

curl "$BASE/api/v1/bot/events?cursor=&limit=100" \
  -H "Authorization: Bearer $TOKEN"

METADATA=$(cat <<'JSON'
{
  "version": 1,
  "blocks": [
    {
      "type": "actions",
      "elements": [
        {
          "type": "button",
          "action_id": "approve",
          "text": "Approve",
          "style": "primary",
          "data": "{\"release\":\"v2.3.0\"}"
        },
        {
          "type": "button",
          "action_id": "reject",
          "text": "Reject",
          "style": "danger",
          "data": "{\"release\":\"v2.3.0\"}"
        }
      ]
    }
  ]
}
JSON
)
 
curl -X POST "$BASE/api/v1/bot/messages" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg cid "$CHANNEL_ID" --arg meta "$METADATA" '{
    conversation_id: $cid,
    content: "Release v2.3.0 готов к выкатке. Подтверди или отклони.",
    metadata_json: $meta
  }')"

"""
PartyFlow interactive callback receiver.
"""
import hashlib
import hmac
import json
import os
import time
 
from fastapi import FastAPI, Header, HTTPException, Request
 
BUTTONS_SECRET = os.environ["BUTTONS_SECRET"].encode()
ALLOWED_USERS = set(os.environ.get("APPROVERS", "").split(","))  # optional ACL
 
app = FastAPI()
 
 
def verify_signature(secret: bytes, timestamp: str, body: bytes, signature: str) -> bool:
    # Anti-replay: reject requests older than 5 minutes.
    try:
        if abs(int(time.time()) - int(timestamp)) > 300:
            return False
    except ValueError:
        return False
    base = f"v1:{timestamp}:".encode() + body
    expected = "sha256=" + hmac.new(secret, base, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)
 
 
@app.post("/partyflow/interactive")
async def interactive(
    request: Request,
    x_partyflow_signature: str = Header(default=""),
    x_partyflow_timestamp: str = Header(default=""),
    x_partyflow_event: str = Header(default=""),
):
    body = await request.body()
 
    if not verify_signature(BUTTONS_SECRET, x_partyflow_timestamp, body, x_partyflow_signature):
        raise HTTPException(401, "invalid signature")
 
    event = json.loads(body)
    action_id = event.get("action_id")
    actor_user_id = event.get("actor_user_id")
 
    # button.click — approve/reject release.
    if x_partyflow_event == "button.click":
        # Optional: restrict by user list. If you set visibility_user_ids
        # in the button schema, PartyFlow already enforces this — but a
        # server-side check is still cheap insurance.
        if ALLOWED_USERS and actor_user_id not in ALLOWED_USERS:
            return {"ephemeral_text": "У вас нет прав для этого действия."}
 
        data = json.loads(event.get("data") or "{}")
        release = data.get("release", "?")
 
        if action_id == "approve":
            return {
                "update_message": {
                    "text": f":white_check_mark: Release {release} approved by <@{actor_user_id}>. Deploying…",
                    "metadata_json": "",  # пустая строка = убрать все интерактивные блоки
                }
            }
        if action_id == "reject":
            return {
                "update_message": {
                    "text": f":x: Release {release} rejected by <@{actor_user_id}>.",
                    "metadata_json": "",
                }
            }
 
    # Default — silent ack.
    return {"noop": True}

pip install fastapi uvicorn
export BUTTONS_SECRET='<тот-же-hex-secret-из-шага-2>'
uvicorn receiver:app --host 0.0.0.0 --port 8081

{
  "event_type": "button.click",
  "payload_json": "{\"interaction_id\":\"int-1\",\"event_type\":\"button.click\",\"space_id\":\"sp-1\",\"actor_user_id\":\"u-1\",\"conversation_id\":\"conv-1\",\"message_id\":\"msg-1\",\"action_id\":\"approve\",\"data\":\"{\\\"release\\\":\\\"v2.3.0\\\"}\",\"occurred_at\":\"2026-04-18T10:00:00Z\"}"
}

curl -X POST "$BASE/api/v1/bot/interactions/$INTERACTION_ID/respond" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"update_message":{"text":"Release approved.","metadata_json":""}}'

POST https://your-bot.example.com/partyflow/interactive
X-PartyFlow-Event: modal.submit

{
  "event_type": "modal.submit",
  "action_id": "deploy_config",
  "actor_user_id": "...",
  "space_id": "...",
  "conversation_id": "...",
  "message_id": "...",
  "values": {"reason": "Fix critical bug", "notify": true},
  "occurred_at": "..."
}

if x_partyflow_event == "modal.submit":
    values = event.get("values", {})
    reason = values.get("reason", "")
    return {
        "send_message": {
            "text": f":rocket: Deploy started. Reason: {reason}",
            "metadata_json": "",
        }
    }