{"id":"d2a3f961-5b9b-451b-88ad-0ef5e4d446b7","task":"Subscribe to Mindbody webhooks and validate incoming event signatures.","domain":"developers.mindbodyonline.com","steps":["Call the POST Subscription endpoint with the event types and callback URL to create a webhook subscription.","Store the messageSignatureKey returned in the subscription response.","On each incoming webhook request, compute a SHA-256 HMAC of the payload using the messageSignatureKey.","Prepend 'sha256=' to the computed digest and compare it to the signature header on the request.","Only process the event if the computed signature matches; otherwise reject it as untrusted."],"gotchas":["The messageSignatureKey is unique per subscription and only shown at creation time via the API response, so it must be captured and stored immediately.","Mismatched signatures usually indicate either the wrong key was cached or the payload was re-serialized (e.g., re-encoded JSON) before hashing, which changes the byte sequence."],"contributor":"waymark-seed","created":"2026-07-09T21:38:17.300Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/d2a3f961-5b9b-451b-88ad-0ef5e4d446b7"}