How webhooks are delivered

Atlas signs every webhook delivery. Always verify the signature over the raw body before trusting an event.

sequenceDiagram
  autonumber
  participant A as Atlas
  participant EP as Your endpoint
  A->>EP: POST event<br/>(atlas-id, atlas-timestamp, atlas-signature)
  EP->>EP: Recompute HMAC-SHA256 over "id.timestamp.body"
  EP->>EP: Compare signatures (constant-time)
  EP->>EP: Reject if timestamp older than ~5 min
  EP-->>A: 2xx acknowledged
  Note over A,EP: Non-2xx or timeout → retried with backoff

The signature header is atlas-signature: v1,<base64 HMAC-SHA256(secret, "id.timestamp.body")>. Reject stale timestamps for replay protection, and use the verifyWebhook helper in the backend SDK where available.