Create a webhook

URL to post the record to once the event is triggered.

Highly Recommended. If provided, you can use this string to verify that authenticity of webhooks sent to target_url. All webhooks you subscribe to you will send a X-Signature header. To determine whether the X-Signature header is valid take the body of the webhook response, append the value of the X-Request-Id header to it, and then generate a HMAC-SHA256 hash of it using your secret as a key. That final result should match the hash found in the X-Signature header. Here are two examples of the verification process in PHP and Python 3:

$secret = 'yourSecretHere';
$webhookBody = '{}';

// `X-Request-Id` header
$requestId = '5d6ce3f9-cce8-4b5b-a26e-396a6161eb99';

// `X-Signature` header
$signature = 'HMAC-SHA256 affc8d589f36580daa0d587ac0b314c123b59322cf4d018661e0a403cc76391f';

$hash = hash_hmac('sha256', $requestBody . $requestId, $secret, false);

if ($signature !== 'HMAC-SHA256 ' . $hash) {
    // Reject it
}