Webhooks

Some providers push events rather than waiting to be polled. Those arrive at a workspace-specific address, and every one is verified before anything reads it.

The address carries the installation

https://hawiagents.com/api/integrations/webhooks/{connector}/{installation_id}

The installation identifier in the path is what ties an inbound event to one workspace's connection. It is not a secret and it is not what authenticates the request — the signature does that — but it should not be published either.

Verification fails closed

• Signatures are checked against the shared secret before the body is parsed.
• Where a provider signs with a timestamp, the timestamp is checked too, so a valid signature captured and replayed later is rejected.
• A provider whose scheme is not implemented is refused rather than trusted. An unverifiable event is dropped, not accepted with a warning.
• Events outside the allowlist for that connector are ignored even when correctly signed.

Registration

Most connectors need the webhook registered by hand in the provider's console. A few can register it themselves once connected. The connector's own setup screen says which, and where it is manual it shows the exact address to paste.