Vouched Webhook

Vouched's POST of a finished (or re-reviewed) ID check.

⛔THE SIGNATURE IS THE ONLY THING THAT MAKES THIS TRUSTED. X-Signature is base64(HMAC-SHA1) of the RAW body under our private key (or the account's signature key) -- Vouched's Webhooks page. It is checked on await request.body(), the exact bytes received, before the body is parsed; a forged or unsigned POST gets 401 and nothing is read or written (id_check.record_from_webhook). ref is the attempt's own reference, which Roost put in the callbackURL when the attempt began.

A genuine webhook Roost has no attempt for is acknowledged (200, recorded: false) so Vouched does not retry it for ever.