assumption-profile.published
Your organization published a new assumption profile version (POST /api/v1/assumption-profiles). Runs pinned to an earlier version are unchanged; previousVersion names the version this one most recently follows.
Headers
Stable across retries of one event to one endpoint; deduplicate on it.
Unix seconds at this attempt (fresh on each retry); reject stale timestamps on your side.
'sha256=' + hex(HMAC-SHA256(secret, ${timestamp}.${rawBody})).
For 24 hours after a secret rotation: the same signature under the previous secret.
Payload
Response
Receipt. Any non-2xx (or a redirect, or a 5-second timeout) is a failed attempt, retried up to five more times with backoff. An event's first failed attempt counts toward auto-disable — 10 consecutive failed events disable the endpoint; any successful delivery resets the count.
Changes
Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.