Authentic and Idempotent Persona Event Intake

Overview

A webhook is an untrusted delivery until its signature passes. Persona may deliver duplicates or events out of order, so authenticity, durable receipt, idempotency, event-time ordering, and resource reconciliation are distinct steps.

Prerequisites

• HTTPS endpoint retaining exact raw request bytes
• Persona webhook secret with rotation metadata
• Durable unique event store and reconciliation worker

Instructions

Step 1: Capture before parsing

Read the exact raw bytes and Persona-Signature header. Enforce size, method, content-type, and timestamp policy before business work.

Step 2: Parse signature candidates