Subscribe to signed events

Maximum 10 enabled hooks. Save the returned secret securely; it is shown only at creation. HTTPS port 443 and publicly resolving IPv4 DNS required. Private/mixed IPs, URL credentials, fragments and redirects are rejected. Registration is not idempotent: list before retrying after a timeout; 409 webhook_limit_reached at the maximum. Delivery is best-effort: up to three attempts, retried on network errors, 5xx and 429; not a durable replay queue. Verify signatures on the exact raw body (X-PumpGTM-Signature, t=<unix>,v1=<hex HMAC-SHA256 of t + "." + body>; reject t older than 5 minutes) and deduplicate event IDs. x.followed means an inbound follow of your connected account. lead.messaged includes successful x_dm with channel x; reply.received can include unreadable encrypted content. linkedin.connected fires on the partner workspace when an end user completes a hosted connect link; register it with the partner key. linkedin.disconnected fires when a connected LinkedIn identity stops being usable (source: provider, dashboard or api), on the owning workspace and, for a partner end user, on the partner workspace. linkedin.limited fires once when LinkedIn declines an account's connection requests and invites are held (data.account{id,displayName}, reason invite_limit, heldSince, retryAt = earliest automatic retry, attempt 1..3; a failed retry fires it again with the next attempt); linkedin.resumed fires when a retry goes through (data.account, resumedAt, warmupRestarted true: the account re-enters the six-day warm-up ramp). Messages and other steps keep running during a hold; nothing to do on your side.