Prepare for event-driven integrations.

Events need a verified contract too.

The published webhook contract will define event names, payloads, signatures and delivery behavior. Until that contract is available, do not assume a header name, signing method or retry schedule.

When implementing a supported webhook, follow its documented signature verification and duplicate-delivery guidance. Keep private endpoint URLs and signing secrets out of support messages and public examples.