Receive a signed destination event and record it on the intent's timeline
Inbound delivery from a destination platform, addressed to the destination’s webhook URL for this tenant. No bearer token: the X-Signature-HMAC-SHA256-1 header authenticates the delivery and an unverifiable one is rejected, not queued. The body must reference an Intent ID this tenant minted; the event lands on that intent’s timeline as webhook.received and drives back-sync.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Headers
Base64-encoded HMAC-SHA256 of the raw request body, computed with one of the active signing keys. The numeric suffix carries no meaning: during key rotation a delivery may carry several X-Signature-HMAC-SHA256-{n} headers and any one matching an active key verifies it. Comparison is timing-safe.
Path Parameters
The destination key the event comes from, e.g. beeline or fieldglass. Must be a configured destination.
Body
Back-sync event envelope delivered by composerID webhooks, and accepted inbound at POST /webhooks/{platform}. Signed in transport, not in the body: each delivery carries one or more X-Signature-HMAC-SHA256-{n} headers, each the Base64 HMAC-SHA256 of the raw body under an active signing key; any one match verifies, so keys rotate without downtime.
Event type. Current taxonomy is VMS-scoped; additional event families (assessment, document, workflow) are planned.
vms.requisition.updated, vms.assignment.updated, vms.timesheet.updated, vms.connection.revoked The intent this event relates to.
^[A-Za-z0-9_-]{10,64}$Event-specific payload. Structure depends on the event type.
x >= 1Source provider key.
Object ID in the source system.
Deprecated and ignored by verifiers. Signatures travel in the X-Signature-HMAC-SHA256-{n} request headers, never in the body, so the signed bytes are exactly the bytes received. Kept only so existing senders that set it still validate.
Unique delivery ID for deduplication.
Response
Accepted
The delivery was verified and recorded as a webhook.received event on the intent's timeline.
Minted at the decision and carried unchanged into every destination record. Fits a 64-character client-supplied id field, which is how the same id finds the record in either direction.
^[A-Za-z0-9_-]{10,64}$"itn_7f3aK2mQ9xLp"
The destination key the event came from, echoed from the path.