Sent to every enabled endpoint subscribed to booking.created.

Verify the relaw-signature header before trusting the body. It is t=<unix>,v1=<hex>, where the hex is HMAC-SHA256 of <t>.<raw body> keyed with your endpoint's signing secret. Reject anything where t is more than five minutes from now — the timestamp is inside the signed material precisely so it cannot be rewritten to extend a captured request's life.

Respond 2xx to acknowledge. A 5xx is retried; a 4xx is treated as a permanent refusal and not retried. Endpoints that fail 20 times consecutively are disabled, and the firm is told why.

Retries reuse the same relaw-event-id. Deduplicate on it: delivery is at-least-once, not exactly-once.