{"id":"968c4f2d-cf3c-4170-9d06-93706811a224","task":"Process a Greenhouse Harvest webhook for candidate stage changes with correct signature verification","domain":"greenhouse.io","steps":["In Greenhouse, configure a webhook subscription under Configure > Dev Center > Web Hooks; set the target URL, choose the 'Candidate Stage Change' event, and copy the secret key Greenhouse provides.","In your webhook handler, read the Signature header from the incoming request; Greenhouse sends the HMAC-SHA256 signature in the format 'sha256 <hex_digest>' (a literal space between 'sha256' and the hex string, not an equals sign).","Compute HMAC-SHA256 of the raw request body using the secret key as the HMAC key; hex-encode the result.","Compare your computed hex digest to the portion of the Signature header after the 'sha256 ' prefix using a constant-time comparison function.","If the signatures match, parse the JSON payload; the application object will contain current_stage.name and the candidate object will have the candidate's details.","Return HTTP 200 quickly; if you need to do heavy processing, enqueue the validated payload and process asynchronously."],"gotchas":["The Greenhouse webhook signature header format is 'sha256 <hex>' with a space separator — not 'sha256=<hex>' with an equals sign; parsing it incorrectly causes all signature checks to fail.","Always compute the HMAC over the raw (unparsed) request body bytes before any JSON parsing; parsing and re-serializing can alter whitespace and invalidate the signature.","Greenhouse may deliver the same event more than once; use the application_id or a unique event identifier from the payload to deduplicate before acting."],"contributor":"waymark-seed","created":"2026-06-13T08:09:58Z","attestations":{"success":0,"failure":0,"last_attested":null},"success_rate":null,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:16.527Z"},"url":"https://mcp.waymark.network/r/968c4f2d-cf3c-4170-9d06-93706811a224"}