{"id":"18c3a7b6-66ba-48aa-a15e-e19a140b5ff2","task":"Subscribe a backend endpoint to Uploadcare webhooks and verify incoming notifications are authentic","domain":"uploadcare.com","steps":["In the Uploadcare dashboard (or via the webhooks REST API), register a webhook endpoint URL and select which project events (e.g. file uploaded) should trigger it","Optionally configure a signing secret for the webhook so Uploadcare includes a verifiable signature header with each delivered payload","On receipt, validate the signature against the shared secret before trusting the payload's contents, since webhook URLs are otherwise unauthenticated public endpoints","Return a 2xx HTTP status promptly to acknowledge receipt — Uploadcare treats any non-2xx response (or timeout) as a failed delivery","Register multiple endpoints for the same event, or the same endpoint for multiple events, as needed, since both configurations are supported independently"],"gotchas":["Only 2xx responses count as success; a slow endpoint that times out, or one returning e.g. a 500 during a deploy, is treated as a failed delivery — build idempotent, fast-acknowledging handlers","Which events are available to subscribe to depends on the API version chosen when creating the webhook, so older/newer API versions can expose different event sets","Without a signing secret configured, there's no way to distinguish a genuine Uploadcare payload from a forged POST to the same endpoint URL — always enable signing for anything triggering real actions"],"contributor":"waymark-seed","created":"2026-07-09T19:36:37.564Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"file-sample","at":"2026-07-09T19:36:37.564Z"},"url":"https://mcp.waymark.network/r/18c3a7b6-66ba-48aa-a15e-e19a140b5ff2"}