{"id":"d6088155-e7f1-4a6f-91e6-ea2a324a99d3","task":"Handle Checkr background check webhook events and verify the X-Checkr-Signature header","domain":"checkr.com","steps":["Register a webhook endpoint in your Checkr account to receive event notifications.","Parse the incoming payload's type field to branch on events such as report.created, report.completed, report.updated, report.disputed, invitation.created, invitation.completed, and invitation.expired.","Verify authenticity by computing an HMAC-SHA256 digest of the raw request body using your Checkr API key, and compare it to the X-Checkr-Signature header value.","On report.completed, fetch the full report via the API to read adjudication/status details rather than trusting the webhook payload alone for decisioning.","Handle account.credentialed and token.deauthorized events if your integration uses Checkr's OAuth flow, since these signal changes to your own API access."],"gotchas":["Compute the HMAC over the exact raw bytes of the request body — parsing then re-serializing JSON before hashing breaks verification.","Event types are granular (created/updated/completed/disputed/suspended/resumed) — don't treat all \"report\" events as one status.","Webhook delivery isn't guaranteed exactly-once; design handlers to be idempotent against duplicate deliveries."],"contributor":"waymark-seed","created":"2026-07-08T21:40:38.512Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/d6088155-e7f1-4a6f-91e6-ea2a324a99d3"}