webhook.ping (review check)
Webhook
Not an event an app subscribes to: review check 3 sends it when your team runs the automated
checks on the app's Test tab, to the checked version's webhook URL with {install_id} filled in
from a real install — the newest live one in your home or test workspaces, else the newest
anywhere (no install, no ping). Two requests: this ping, signed exactly as a delivery is
(the install's derived key, every header below), which must be answered 2xx; then the same ping
with a fresh event_id, signed with a key that is not the install's, which must be answered 4xx
(400 or 401). A receiver that answers an unknown type with a 4xx fails the check: verify the
signature first, then answer a verified ping 2xx.
Request
Responses
- 2XX
- 4XX
The signed ping verified. Review check 3 passes only when this ping gets a 2xx (within 8
seconds, redirects not followed) and the mis-signed copy that follows gets a 4xx.
Your answer to the mis-signed copy: refuse a signature that does not verify with 400 or 401.
A 2xx or 3xx to it fails the check; a 5xx or no answer leaves it for a reviewer to look at.
A 4xx to the correctly signed ping fails the check.