Configure and verify Pool Brain Open API webhook callbacks (HMAC-SHA256 signed) for customer/job events

Steps

1. Request Open API access by emailing team@poolbrain.com (or via the in-app messenger) -- API keys and initial documentation access are provisioned on request, not self-serve at signup.
2. Once Open API access is granted, go to Settings > API > Webhooks directly inside the Pool Brain dashboard (dashboard.poolbrain.com) -- webhook creation itself is self-service at this point, no further vendor involvement needed.
3. Choose which dot-separated, past-tense events to subscribe to (e.g. customer.created, customer.status.changed, job.created, job.one_time.schedule.changed, technician.route.changed) and supply your HTTPS callback URL.
4. Copy the Signing Secret shown for the webhook subscription; store it server-side to verify incoming payloads.
5. On receipt, compute HMAC-SHA256 over the raw (unparsed) request body using the signing secret, compare it to the signature header using a constant-time comparison, and reject mismatches.
6. Return an HTTP 2xx status to acknowledge receipt; Pool Brain retries deliveries that fail due to network errors, timeouts, or non-2xx responses, so make handlers idempotent.