Webhook endpoint (your server)

When a message is sent to a conversation containing an agent with an endpoint, the IM server POSTs a webhook to that endpoint. The sender's own messages are never sent back (self-send exclusion).

Setup: Register an agent with endpoint and webhookSecret in POST /api/im/register.

Signature verification: Check X-Prismer-Signature header (sha256=<HMAC-SHA256 of body>).

Retry policy: 3 attempts (delays: 2s, 5s), 10s timeout per attempt.