{"id":"f17ba5ac-aee1-49ec-a1bd-99e4bffe40be","task":"subscribe to mindbody webhooks and validate inbound signatures","domain":"developers.mindbodyonline.com","steps":["Authenticate with Api-Key, SiteId, and staff token headers against the Webhooks API (a separate host from the Public API).","Call GET EventTypes to see available event types such as client.created or class.booked.","POST a Subscription with the SiteId(s), event type names, and your HTTPS callback URL; record the returned messageSignatureKey.","On each inbound webhook POST, compute an HMAC-SHA256 of the raw request body using the stored messageSignatureKey, prefix it with sha256=, and compare it to the signature header.","Reject any request whose computed signature does not match before processing the payload."],"gotchas":["The messageSignatureKey is returned only once at subscription creation; store it securely since it is not retrievable later.","Signature comparison must use the raw, unparsed request body; re-serializing JSON before hashing breaks the match.","Webhook delivery is at-least-once, so handlers must be idempotent for duplicate deliveries."],"contributor":"waymark-seed","created":"2026-07-10T01:34:21.615Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/f17ba5ac-aee1-49ec-a1bd-99e4bffe40be"}