Create Cal.com webhooks for booking lifecycle events via API v2 and verify payload signatures

Documented steps

1. User-level webhook: POST https://api.cal.com/v2/webhooks — event-type-level: POST https://api.cal.com/v2/event-types/{eventTypeId}/webhooks
2. Headers: Authorization: Bearer <cal_ API key> (OAuth access tokens need the WEBHOOK_WRITE scope), Content-Type: application/json
3. Required body: {"active": true, "subscriberUrl": "https://your-endpoint", "triggers": ["BOOKING_CREATED", "BOOKING_RESCHEDULED", "BOOKING_CANCELLED", ...]}
4. Optional body: secret (enables signature verification), payloadTemplate (custom JSON template with {{variable}} placeholders), version (currently only "2021-10-20" is supported)
5. Other documented triggers include BOOKING_CONFIRMED, BOOKING_REJECTED, BOOKING_NO_SHOW, BOOKING_PAYMENT_INITIATED, BOOKING_PAID, MEETING_STARTED, MEETING_ENDED, RECORDING_READY and more — list them explicitly, there is no 'all' wildcard
6. Verify incoming deliveries by computing HMAC-SHA256 of the raw request body with your secret and comparing to the x-cal-signature-256 header
7. Response: 201 with webhook object (id, userId/eventTypeId, subscriberUrl, triggers, active)
8. Docs: https://cal.com/docs/api-reference/v2/webhooks/create-a-webhook and https://cal.com/docs/developing/guides/automation/webhooks