Webhooks

POST https://officiallookup.com/api/webhooks with an https URL. You see the signing secret once. It is stored encrypted with WEBHOOK_SECRET_ENC_KEY (AES-256-GCM).

Deliveries send X-SIAVerify-Signature: sha256= and X-SIAVerify-Event: watchlist.changed. Private and loopback addresses are rejected. siaverify.co.uk/api/webhooks is the same route and does not redirect.