Provider Callbacks

External provider callback ingress

Callback ingress with signature verification and replay-safe processing. **Signature.** Compute an HMAC-SHA256 over the following string, using the webhook secret configured for your provider account: ``` {timestamp}.{requestId}.{eventId}.{rawBody} ``` - `{timestamp}` — the value you send in `x-provider-timestamp`: whole seconds since the epoch. Required. Rejected beyond ±300s of server time (`PROVIDER_CALLBACK_TIMESTAMP_SKEW`). - `{requestId}` — the id in the callback URL. If the body also carries `requestId`, it must match, or the call is rejected (`PROVIDER_CALLBACK_REQUEST_ID_MISMATCH`). - `{eventId}` — the value you send in `x-provider-event-id`. Used for replay dedup; it is inside the signed string, so it cannot be altered to re-admit a processed callback. - `{rawBody}` — the exact request body bytes you transmit. The signature is verified against those bytes, not against a re-serialization, so key order and whitespace matter. Send the hex digest in `x-provider-signature`, optionally prefixed `sha256=`. **This binding is the security property.** Signing the body alone would make a captured `(body, signature)` pair valid for every signing request in the organization, indefinitely. - duplicate callback events are idempotently acknowledged (`replayed=true`) - terminal provider failures are persisted and can be retried via external request retry APIs