Subscribe to Bob (HiBob) Webhooks v2 and verify event authenticity with the HMAC signature
domain: hr-payroll · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
In Bob, open a module's Webhooks section (Employee, Time off, Task, Docs, or Workforce planning events) and add a webhook pointing to a public HTTPS endpoint
Respond immediately with HTTP 200 to Bob's initial "Ping test" POST to validate the connection
On each event, read the v2 payload's type, triggeredBy, triggeredAt, and data fields, then call Bob's API to fetch the full record referenced by the entity ID
Compute HMAC-SHA512 over the raw request body using the webhook secret from the Bob UI, base64-encode it, and compare against the Bob-Signature header
Return HTTP 200 within Bob's timeout window to avoid entering the retry queue
Known gotchas
Bob retries a failing webhook for up to 3 days with exponential backoff, then deactivates it and emails Admins - a slow endpoint can cause data gaps if not reactivated in time
Webhooks v1 remains usable in parallel but new webhooks can only be created as v2, so plan new integrations around the v2 payload shape
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?