Webhooks
Subscriptions use an independent HMAC-SHA256 secret over timestamp + raw body. Certificate ES256 verification is separate and must not be mixed.
- Header X-VGO-Signature is lowercase hex of HMAC-SHA256(timestamp + '.' + raw_body).
- Allow ±5 minutes clock skew; persist before acknowledging; use status_version against out-of-order updates.
- Retries keep event_id; dead-letter after 24 hours.
Example headers
X-VGO-Timestamp: 1727625600
X-VGO-Signature: <hmac-sha256 hex of timestamp + '.' + raw_body>Verify against the raw body bytes. Do not re-serialize JSON. Certificate ES256 verification stays separate.