The REST API, API clients, and webhooks — Receive webhook events

A webhook subscription POSTs each matching record change to your URL. Subscribe to any of record.created, record.updated, record.deleted, and record.restored, for all tables or a single one. Each delivery carries an X-RowFold-Event header, a unique X-RowFold-Delivery id, and an X-RowFold-Signature; update payloads include the record's previous values so your receiver can diff. Verify every delivery. The signature header reads t=,v1=. Recompute an HMAC-SHA256 over timestamp + "." + rawBody using the hook's secret, compare it to v1 in constant time, and reject timestamps older than five minutes to stop replays — that proves the POST really came from RowFold. Answer with any 2xx within 10 seconds.