Skip to main content
WEBHOOK

Authorizations

​
Authorization
string
header
required

Client credentials, the production model: server-to-server, short-lived tokens, least-privilege scopes, rotation by issuing a new client secret.

Body

application/json

Back-sync event envelope delivered by composerID webhooks, and accepted inbound at POST /webhooks/{platform}. Signed in transport, not in the body: each delivery carries one or more X-Signature-HMAC-SHA256-{n} headers, each the Base64 HMAC-SHA256 of the raw body under an active signing key; any one match verifies, so keys rotate without downtime.

​
event
enum<string>
required

Event type. Current taxonomy is VMS-scoped; additional event families (assessment, document, workflow) are planned.

Available options:
vms.requisition.updated,
vms.assignment.updated,
vms.timesheet.updated,
vms.connection.revoked
​
intent_id
string
required

The intent this event relates to.

Pattern: ^[A-Za-z0-9_-]{10,64}$
​
timestamp
string<date-time>
required
​
payload
object
required

Event-specific payload. Structure depends on the event type.

​
intent_version
integer
Required range: x >= 1
​
provider
string

Source provider key.

​
external_id
string

Object ID in the source system.

​
signature
string
deprecated

Deprecated and ignored by verifiers. Signatures travel in the X-Signature-HMAC-SHA256-{n} request headers, never in the body, so the signed bytes are exactly the bytes received. Kept only so existing senders that set it still validate.

​
delivery_id
string

Unique delivery ID for deduplication.

Response

200

Acknowledged