Webhooks

Some providers push events rather than waiting to be polled. Those arrive at a workspace-specific address, and every one is verified before anything reads it.

The address carries the installation

https://hawiagents.com/api/integrations/webhooks/{connector}/{installation_id}

The installation identifier in the path ties an inbound event to one workspace connection. The request signature provides authentication. Keep the identifier private even though it carries no authentication authority.

Verification fails closed

• Signatures are checked against the shared secret before the body is parsed.
• Where a provider signs with a timestamp, the timestamp is checked too, so a valid signature captured and replayed later is rejected.
• A provider whose scheme is not implemented is refused rather than trusted. An unverifiable event is dropped, not accepted with a warning.
• Events outside the allowlist for that connector are ignored even when correctly signed.

Registration

Most connectors need the webhook registered by hand in the provider's console. A few can register it themselves once connected. The connector's own setup screen says which, and where it is manual it shows the exact address to paste.