The agent-safety verdict held a message BEFORE delivery — we never hold without telling you

postWebhookinbound.quarantined

Headers

x-oveyon-eventstring required

x-oveyon-timestampinteger required

Epoch seconds. Reject if |now − timestamp| > 300 s.

x-oveyon-signaturestring required

sha256= + HMAC-SHA256(secret, timestamp + "." + raw body).

Payload

event'inbound.quarantined' required

eventIdstring uuid required

Unique per POST (it is the delivery uid, never reused) — dedupe on it.

timestampstring date-time required

Response

Answer 2xx fast. Nothing was delivered: the body is held until a human releases it in the panel; reply via API answers 409 message_quarantined meanwhile.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.