Vindur Webhooks

Webhook capability is documented for future partner integrations. Events include spot.created, spot.updated, and catalog.refreshed.

Signature Verification

Verify X-Vindur-Signature with HMAC-SHA256 over the timestamp and raw request body. Reject timestamps older than five minutes.

expected = hmac_sha256(secret, timestamp + "." + rawBody)