Something changed in a workspace you subscribed to
Delivered at least once, so deduplicate on the payload's id, which is the mutation id and is stable across retries. Verify x-indraft-signature before trusting the body: it is t=<unix seconds>,v1=<hex> where the hex is an HMAC-SHA256 of <t>.<raw body> under your endpoint's signing secret, which is shown once when the endpoint is registered. The timestamp is inside the signed material, so a captured delivery cannot be replayed later with a fresh one. Compare in constant time, and reject a timestamp far from your own clock. Respond 2xx to acknowledge; anything else is retried with backoff.
Payload
Response
Acknowledged. Anything outside 2xx is retried.
Changes
Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.