Webhooks: payloads & signature

Event shape, headers and signature verification.

Payload

{
  "id": "evt_…",
  "type": "consent.granted",
  "createdAt": "2026-09-08T12:00:00.000Z",
  "environment": "LIVE",
  "data": { "subjectId": "…", "purpose": "marketing_email", "state": "GRANTED",
            "purposeVersion": 3, "recordId": "…", "receiptId": "rcpt_…" }
}

Headers

• x-tripticonsent-event — the event type
• x-tripticonsent-delivery — delivery id (for idempotency on your side)
• x-tripticonsent-signature — t=<unix>,v1=<hex hmac-sha256>

Verify

1. Extract t and v1 from the signature header.
2. Reject if |now - t| exceeds your tolerance (e.g. 300 s).
3. Compute HMAC-SHA256(secret, "<t>.<rawBody>") and constant-time compare with v1.