Webhooks | Trusted Care

01 / CONCEPT

Integration contract

01

Registration

Register HTTPS endpoint, event subscription and responsible owner.

02

Signature

Verify signature and timestamp before parsing the event body; rotate signing material through a controlled lifecycle.

03

Delivery

Acknowledge quickly, process asynchronously and deduplicate by event identifier.

04

Failure

Expect retries, duplicates and possible out-of-order delivery; replay is an operational action with evidence.

02 / WORKFLOW

From sandbox to evidence

01Register endpoint/subscription
02Receive signed event
03Verify timestamp/signature
04Acknowledge delivery
05Deduplicate and process asynchronously
06Retry/replay on recoverable failure
07Correlate result

03 / EXAMPLE

Receive alert webhook

cURL / pseudocode

verifySignature(rawBody, signature, timestamp);
if (seen(event.id)) return 204;
enqueue(event); return 204;

04 / SECURITY & PRODUCTION

Production is an evidence decision

Webhook consumers must verify signatures, deduplicate, tolerate retry/out-of-order delivery and keep processing asynchronous before production approval.