Event Notification

MPS sends an HTTP POST to the URL configured in your platform's events subscription
whenever a subscribed event occurs. The endpoint must respond with a 200 status code
to acknowledge receipt; any other status causes the notification to be marked as failed.

Payload format

The payload format is determined by the request_format of the events subscription:

• form_data (default) — body is sent as application/x-www-form-urlencoded.
• json — body is sent as application/json.

Signature

If a signing secret has been generated for the platform, every notification includes an
X-Mps-Event-Signature header containing an HMAC SHA-256 signature of the JSON
serialization of the notification payload, computed using the platform's signing secret.
The header value is formatted as:

X-Mps-Event-Signature: sha256=<hex_digest>

Important: regardless of the subscription's request_format, the signature is always
computed over the JSON-encoded notification body (see EventNotificationBody below).
When the subscription is configured as form_data, you must reconstruct the JSON
representation of the notification fields to verify the signature.

To verify a notification, recompute the HMAC SHA-256 of the JSON-encoded notification
body using your signing secret and compare the resulting hex digest to the value
provided after the sha256= prefix. Notifications received without this header (or
with a mismatching signature) should be rejected when a secret is configured.

The secret is generated, regenerated, or deleted from the platform's events
subscriptions page in the agent back office.