Availability Webhooks
Company super admins manage subscriptions from the developer portal dashboard. The current API supports one event type: com.suprsync.workforce.resource.changed.v1.
A subscription must be linked to an API key with an explicit webhooks:manage scope. Legacy keys without stored scopes do not grant webhook management. The signing secret is returned only when the subscription is created or its secret is rotated.
Deliveries include these headers:
| Header | Description |
|---|---|
x-suprsync-event-id | Stable event identifier |
x-suprsync-timestamp | Unix timestamp used in the signature |
x-suprsync-signature | v1= followed by the HMAC-SHA256 signature |
Compute the HMAC over <timestamp>.<raw request body> using the whsec_… signing secret and compare it to the signature using a constant-time comparison. Reject stale timestamps and deduplicate by event ID.
The service retries failed deliveries with backoff. Failed or dead deliveries can also be retried from the dashboard. A subscription is automatically disabled after 25 consecutive failures.