Kivly sends this request to the webhook URL configured for a location when a subscribed event occurs. Delivery uses a 30 second timeout, up to 3 retries, and a minimum 60 second retry delay (queue scheduling can add latency). Deliveries are persisted before sending; the event id and body remain stable on retries. Duplicates and out-of-order deliveries are possible. Deduplicate by payload.id after durable receipt and return any 2xx. Use HTTPS on port 443; redirects and private IPs are rejected. Verify X-Kivly-Signature-V2 as hex HMAC-SHA256 of timestamp + '.' + raw UTF-8 request body with webhook_token. Compare in constant time and reject timestamps more than 300 seconds from your clock. The legacy X-Kivly-Signature signs only the raw body and remains available for existing receivers.
Return any 2xx response to acknowledge successful receipt.
The receiver rejected the webhook payload.
The receiver failed to process the webhook.