Sent by POST /watches/{watchId}/test, signed and authenticated exactly like a real delivery. Headers: Content-Type: application/json, X-Vaquill-Event: board.test.

Verification. Present only when the watch has a webhookSecret. Prefer the Standard Webhooks headers: webhook-id, webhook-timestamp (Unix seconds) and webhook-signature (v1,<base64>, several space separated while a secret rotates), an HMAC-SHA256 over {webhook-id}.{webhook-timestamp}.{raw body}. The HMAC key is the base64 decoding of the secret after whsec_ when it has that prefix, otherwise the secret's UTF-8 bytes. Verify against the raw bytes before parsing, and reject a timestamp more than 5 minutes old. webhook-id is stable across retries of one delivery. The legacy X-Vaquill-Signature: sha256=<hex> header (HMAC-SHA256 of the raw body) is also sent, is deprecated, and remains for at least 12 months. Respond with any 2xx to acknowledge; redirects are not followed.