Verify every event. Handle duplicates safely.

Signature contract

Kobiat-Signature contains t=<Unix timestamp> and one or more v1=<hex HMAC> values. Compute HMAC-SHA256 over timestamp + "." + the exact raw request body, using the saved signing secret. Use a constant-time comparison, reject timestamps outside five minutes, and deduplicate the stable event ID. During a 24-hour rotation overlap, either v1 signature may validate.

$expected = hash_hmac("sha256", $timestamp . "." . $rawBody, $secret);
if (abs(time() - (int)$timestamp) > 300 || !hash_equals($expected, $signature)) {
    http_response_code(401); exit;
}
// Atomically record the event ID before applying a business effect.

Kobiat-Event-ID stays the same across retries and redelivery. Kobiat-Delivery-ID is unique for each attempt. Return 2xx after durable acceptance. Eight failed attempts move a notification to the dead-letter state; the console can request controlled redelivery without repeating the original business operation.

Destinations must use public HTTPS on port 443, without redirects, credentials, fragments or query strings. DNS is resolved, checked and pinned at every connection. Private, link-local, loopback, metadata, mapped and reserved addresses are rejected.