BRP Webhooks

​

Supported Events

​

Payload Format

{
  "event": "nomination.error_detected",
  "timestamp": "2026-01-14T18:25:00Z",
  "data": { ... }
}

​

Signature Verification

1. Extract the X-Webhook-Signature header value from the request.
2. Compute the HMAC-SHA256 of the raw request body using your shared secret.
3. Compare the computed signature with the header value.

# Example: verify a webhook signature
SIGNATURE=$(echo -n "$REQUEST_BODY" | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET" | awk '{print $2}')

if [ "$SIGNATURE" = "$RECEIVED_SIGNATURE" ]; then
  echo "Valid signature"
fi

​

Best Practices

• Respond quickly: Return a 200 status code within a few seconds. Process the event asynchronously if needed.
• Handle duplicates: Events may be delivered more than once. Use the timestamp and event data to deduplicate.
• Monitor failures: If your endpoint fails to respond, Otark will retry delivery with exponential backoff.