Webhooks
A test ping
Sent when the partner calls POST /v1/partner/webhooks/test, signed and retried like every event. Its data is an empty object.
WEBHOOK
Headers
The event id (the id member of the body), the same on every delivery attempt; dedupe on it.
The whole Unix seconds when this attempt was signed. Refuse one more than five minutes from your clock.
"v1," and the base64 HMAC-SHA256 of "..", over the exact bytes of the body, under the key your secret carries in base64 after its whsec_ prefix. Compare in constant time.
Body
application/json
Response
2XX
Acknowledged; the ping is not sent again.

