Receiving webhooks
Copy a handler, set PIVOTAL_WEBHOOK_SECRET from the endpoint’s signing secret, point Pivotal at the URL.
NODE / EXPRESS
webhook-handler.ts
PYTHON / FASTAPI
webhook_handler.py
RULES
- Return a 2xx within 10 seconds. Anything else triggers a retry.
- Read the raw body before parsing JSON. Signature verification fails on re-stringified payloads.
- Idempotency: every retry carries the same
id. Store processed ids for at least 7 days. - Order is best-effort, not guaranteed. Prefer reading state from
data.objectover inferring from event order.