Draft approval events (held, approved, rejected, hold_expired) — opt-in per endpoint

postWebhookholdEvent

Headers

x-oveyon-eventstring required

x-oveyon-timestampinteger required

Epoch seconds. Reject if |now − timestamp| > 300 s.

x-oveyon-signaturestring required

sha256= + HMAC-SHA256(secret, timestamp + "." + raw body).

event'held' | 'approved' | 'rejected' | 'hold_expired'

messageIdstring uuid

recipientstring

statusstring

frozen while held; queued after approval; failed after reject/expiry.

timestampstring date-time

Answer 2xx fast.

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.