A message we already delivered turned malicious (a link was listed AFTER delivery)

postWebhookinbound.retro_flagged

Headers

x-oveyon-eventstring required
x-oveyon-timestampinteger required

Epoch seconds. Reject if |now − timestamp| > 300 s.

x-oveyon-signaturestring required

sha256= + HMAC-SHA256(secret, timestamp + "." + raw body).

Payload

event'inbound.retro_flagged'
eventIdstring uuid

Unique per POST (it is the delivery uid, never reused) — dedupe on it. Distinct from the eventId of the original inbound.received.

timestampstring date-time

Response

Answer 2xx fast. The message itself was NOT changed — it stays delivered; this is a warning, not a recall.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.