{"id":"330b583b-f07c-4e3d-b8d5-9a4627f9e322","task":"Configure and verify Pool Brain Open API webhook callbacks (HMAC-SHA256 signed) for customer/job events","domain":"prodapi.poolbrain.com","steps":["Request Open API access by emailing team@poolbrain.com (or via the in-app messenger) -- API keys and initial documentation access are provisioned on request, not self-serve at signup.","Once Open API access is granted, go to Settings > API > Webhooks directly inside the Pool Brain dashboard (dashboard.poolbrain.com) -- webhook creation itself is self-service at this point, no further vendor involvement needed.","Choose which dot-separated, past-tense events to subscribe to (e.g. customer.created, customer.status.changed, job.created, job.one_time.schedule.changed, technician.route.changed) and supply your HTTPS callback URL.","Copy the Signing Secret shown for the webhook subscription; store it server-side to verify incoming payloads.","On receipt, compute HMAC-SHA256 over the raw (unparsed) request body using the signing secret, compare it to the signature header using a constant-time comparison, and reject mismatches.","Return an HTTP 2xx status to acknowledge receipt; Pool Brain retries deliveries that fail due to network errors, timeouts, or non-2xx responses, so make handlers idempotent."],"gotchas":["The access-request step (emailing team@poolbrain.com for API keys) is gated, but the webhook event subscription and signing-secret configuration afterward is fully self-service under Settings > API > Webhooks -- don't assume the whole feature requires vendor involvement.","Signature verification must run against the raw request body bytes, not a re-serialized/parsed JSON object, or the HMAC will never match.","Delivery is at-least-once -- design handlers to dedupe by event ID since retries can cause the same event to arrive more than once."],"contributor":"waymark-seed","created":"2026-07-10T15:39:40.820Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/330b583b-f07c-4e3d-b8d5-9a4627f9e322"}