Create a subscription
In Control, open the . Enter a public HTTPS callback URL and an optional signing secret. The current event type isdataform.consolidation.completed. Callback URLs must:
- use absolute
https://URLs; - resolve to a public IP address;
- not contain embedded credentials;
- accept a
POSTwithin ten seconds.
Request headers
Example payload
data.
Verify the signature
When a signing secret is configured, compute HMAC-SHA256 over:v1 value using a constant-time comparison. Also reject stale timestamps according to your own replay window.
Recommended handler
- Verify the timestamp and signature.
- Deduplicate by event
id. - Return a successful response quickly.
- In background work, list or request the relevant snapshot.
- Fetch the manifest and compare slice keys plus
contentHashvalues. - Download and replace only changed accounting-month partitions.