Webhook
Table of Contents
Classes
- AxiamWebhooks
- Verifies the `X-Axiam-Signature` HMAC-SHA256 header AXIAM attaches to every webhook
delivery (CONTRACT.md §13, T-145). Mirrors the server's signer
(`crates/axiam-api-rest/src/webhook.rs`'s `compute_signature_v2`): the MAC covers the
ASCII string `<t>.<raw_body>`, keyed with the webhook secret's raw UTF-8 bytes.
- WebhookEvent
- A webhook delivery whose `X-Axiam-Signature` has already been verified by
{@see AxiamWebhooks::verify()} (CONTRACT.md §13). {@see self::$eventType} and
{@see self::$deliveryId} are a best-effort parse of the verified body's `event`/`id`
JSON fields — a non-JSON or differently-shaped body still verifies successfully (the
MAC only covers the raw bytes, not their JSON shape), it simply leaves those two
properties `null`. Callers that need the delivery id for at-least-once dedup (§13.3
rule 7) should prefer the `X-Axiam-Delivery` header over relying solely on this parse.
- WebhookVerificationException
- Thrown by {@see AxiamWebhooks::verify()} when a webhook delivery fails signature
verification (CONTRACT.md §13.3 rule 6: "fail closed and quiet").