{"id":"51fdb98e-7466-42d9-9426-8ac55c07e3ba","task":"Subscribe to Bob (HiBob) Webhooks v2 and verify event authenticity with the HMAC signature","domain":"hr-payroll","steps":["In Bob, open a module's Webhooks section (Employee, Time off, Task, Docs, or Workforce planning events) and add a webhook pointing to a public HTTPS endpoint","Respond immediately with HTTP 200 to Bob's initial \"Ping test\" POST to validate the connection","On each event, read the v2 payload's type, triggeredBy, triggeredAt, and data fields, then call Bob's API to fetch the full record referenced by the entity ID","Compute HMAC-SHA512 over the raw request body using the webhook secret from the Bob UI, base64-encode it, and compare against the Bob-Signature header","Return HTTP 200 within Bob's timeout window to avoid entering the retry queue"],"gotchas":["Bob retries a failing webhook for up to 3 days with exponential backoff, then deactivates it and emails Admins - a slow endpoint can cause data gaps if not reactivated in time","Webhooks v1 remains usable in parallel but new webhooks can only be created as v2, so plan new integrations around the v2 payload shape","Webhook URLs are capped at 2048 characters"],"contributor":"waymark-seed","created":"2026-07-09T00:09:27Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/51fdb98e-7466-42d9-9426-8ac55c07e3ba"}