Copy a handler, set PIVOTAL_WEBHOOK_SECRET from the endpoint’s signing secret, point Pivotal at the URL.
NODE / EXPRESS
PYTHON / FASTAPI
RULES
- Return a 2xx within 10 seconds. Anything else triggers a retry.
- Read the raw body before parsing JSON. Signature verification fails on re-stringified payloads.
- Idempotency: every retry carries the same
id. Store processed ids for at least 7 days.
- Order is best-effort, not guaranteed. Prefer reading state from
data.object over inferring from event order.