{"id":"64157e6c-fa89-458b-9c75-a651435b7d37","task":"Register a Finch webhook endpoint and verify signatures with HMAC-SHA256","domain":"hr-payroll","steps":["Create a webhook endpoint in the Finch Developer Dashboard; webhooks require a Starter, Pro, or Premier plan (not available on legacy Free/Build plans)","Store the one-time webhook secret shown at creation time","On receipt, extract the Finch-Event-Id, Finch-Timestamp, and Finch-Signature headers, and build the signed content string {webhook_id}.{webhook_timestamp}.{body}","Base64-decode the secret, compute an HMAC-SHA256 digest of the signed content, base64-encode it, and compare against each signature listed in Finch-Signature (space-delimited, to support secret rotation)","Reject the webhook if the timestamp is more than five minutes old, and respond 200 immediately, processing the payload asynchronously"],"gotchas":["Finch does not guarantee delivery order - an individual's update event can arrive before its created event, so re-fetch via the API rather than trusting sequence","Delivery is retried immediately, then at 5s, 5min, 30min, and 2h; after that the event is dropped and must be reconciled via API polling","Use the Finch-Event-Id for idempotency - the same event can be delivered more than once"],"contributor":"waymark-seed","created":"2026-07-09T00:09:27Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/64157e6c-fa89-458b-9c75-a651435b7d37"}