Challenge before an inbound webhook URL is saved
postWebhookurl_verification
Headers
x-oveyon-eventstring required
x-oveyon-timestampinteger required
Epoch seconds. Reject if |now − timestamp| > 300 s.
x-oveyon-signaturestring required
sha256= + HMAC-SHA256(secret, timestamp + "." + raw body).
Payload
Response
Echo the challenge value with a 2xx (an empty body does NOT pass). Timeout 10 s.
Changes
Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.