Receive an attributed sparkles event
Sparkles sends one event object per request. Read the unmodified request bytes and reject Webhook-Timestamp values outside a five-minute tolerance. Decode the configured signing secret after removing whsec_, then compare HMAC-SHA256(Webhook-Id + ”.” + Webhook-Timestamp + ”.” + rawRequestBody) in constant time against each space-separated v1 signature. Webhook-Id equals the body UUID and is stable across retries and reconciliation. Return any 2xx only after durably accepting the event. Delivery is at least once; return 410 to disable the endpoint.
Headers
The stable request identifier, equal to the UUID in the request body id.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$Unix seconds for this request and the timestamp used in the signature input.
x <= 9007199254740991One or more space-separated v1,BASE64_HMAC values. Each HMAC-SHA256 signs Webhook-Id.Webhook-Timestamp.rawRequestBody with the base64-decoded whsec_ key.
^(?:v1,[A-Za-z0-9+/]{43}=)(?: v1,[A-Za-z0-9+/]{43}=)*$One-based delivery attempt number.
x <= 9007199254740991Body
- Option 1
- Option 2
- Option 3
- Option 4
- Option 5
- Option 6
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$x <= 9007199254740991"credit_claim.created"Response
Disable this webhook endpoint and stop delivery