SYMBaiEX SYMBaiEX webhooks
- Read the AsyncAPI contract and check the webhook availability endpoint before creating a subscription.
- Use an exact HTTPS destination already permitted by the platform allowlist.
- Store the one-time signing secret outside chat, logs, URLs, browser storage, and source control.
- Verify the HMAC over the exact timestamp and raw request body before parsing JSON. Enforce the documented timestamp window and deduplicate by event ID.
- Use owner-scoped status, health, and bounded history operations. Pause or revoke a destination that fails validation.
- Rotate secrets deliberately and update the receiver immediately. Replay only terminal deliveries that the operator has reviewed.
Never accept an event solely because its JSON shape looks valid. Signature verification and owner isolation are required.