Skip to main content
POST
Receive a signed destination event and record it on the intent's timeline

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

X-Signature-HMAC-SHA256-1
string
required

Base64-encoded HMAC-SHA256 of the raw request body, computed with one of the active signing keys. The numeric suffix carries no meaning: during key rotation a delivery may carry several X-Signature-HMAC-SHA256-{n} headers and any one matching an active key verifies it. Comparison is timing-safe.

Path Parameters

platform
string
required

The destination key the event comes from, e.g. beeline or fieldglass. Must be a configured destination.

Body

application/json

Back-sync event envelope delivered by composerID webhooks, and accepted inbound at POST /webhooks/{platform}. Signed in transport, not in the body: each delivery carries one or more X-Signature-HMAC-SHA256-{n} headers, each the Base64 HMAC-SHA256 of the raw body under an active signing key; any one match verifies, so keys rotate without downtime.

event
enum<string>
required

Event type. Current taxonomy is VMS-scoped; additional event families (assessment, document, workflow) are planned.

Available options:
vms.requisition.updated,
vms.assignment.updated,
vms.timesheet.updated,
vms.connection.revoked
intent_id
string
required

The intent this event relates to.

Pattern: ^[A-Za-z0-9_-]{10,64}$
timestamp
string<date-time>
required
payload
object
required

Event-specific payload. Structure depends on the event type.

intent_version
integer
Required range: x >= 1
provider
string

Source provider key.

external_id
string

Object ID in the source system.

signature
string
deprecated

Deprecated and ignored by verifiers. Signatures travel in the X-Signature-HMAC-SHA256-{n} request headers, never in the body, so the signed bytes are exactly the bytes received. Kept only so existing senders that set it still validate.

delivery_id
string

Unique delivery ID for deduplication.

Response

Accepted

The delivery was verified and recorded as a webhook.received event on the intent's timeline.

ok
boolean
required
intent_id
string
required

Minted at the decision and carried unchanged into every destination record. Fits a 64-character client-supplied id field, which is how the same id finds the record in either direction.

Pattern: ^[A-Za-z0-9_-]{10,64}$
Example:

"itn_7f3aK2mQ9xLp"

provider
string
required

The destination key the event came from, echoed from the path.