Endpoint verification

Body of every webhook delivery: {id, type, created_at, data}, signed as described in this reference (NR-Webhook-Signature over 'timestamp.payload'). Six event types. assessment.updated fires when an assessment's score, band, recommendation, coverage or status changes while it is served; updates that change none of these are coalesced, and the final one has status complete. An expiry is terminal and carries only minimal data: status 'expired', change_reason 'expired', the last served assessment_version and no assessment (GET now answers 404); the consumer deletes what it holds for the assessment. account.deleted fires once when DELETE /v1/accounts/{account_id} erased at least one assessment of the account: its data names the account_id, how many assessments went and when; the consumer deletes what it holds from the account's assessments created at or before data.deleted_at, ignores a later-arriving update of such an assessment, and keeps any assessment created after it (the account assessed again), even when the event arrives last. A repeat erasure that deleted nothing sends no event. workspace.deleted is the last event an environment's endpoints receive: it fires once per environment when its workspace is deleted (DELETE /v1/workspaces/{workspace_id}), after the deletion took effect (every key answers 401, every assessment and account is gone) and before the endpoints themselves are removed; the consumer deletes what it holds for that environment and stops calling the API with its keys. webhook_endpoint.disabled fires when one of the environment's endpoints was disabled after failing continuously for 72 hours: it goes to the environment's other verified endpoints (the disabled endpoint receives nothing until it is verified again), and is not sent when there are none. account.risk_changed fires once when the decision of an account for at least one flow changes: its data is the account as GET /v1/accounts/{account_id} answers it for the revision that made the change (the new score, decisions and reasons) and the decisions per flow it replaced; a score that moves without changing any flow's decision sends nothing, and an account's first risk sends nothing (the assessment answer carries it). An account's changes are fanned out in the order they happened. endpoint.verification carries a challenge the endpoint must echo to prove it is the intended receiver. Deliveries are at-least-once and unordered: deduplicate on id, and drop an assessment whose detail.assessment_version is not newer than the one held. Polling GET /v1/assessments/{assessment_id} stays authoritative. An event sent by POST /v1/webhooks/{endpoint_id}/test carries test: true and a fixed example assessment.

The body an endpoint returns, with status 200 and Content-Type application/json within 5 seconds, to an endpoint.verification event. A 2xx without the echoed challenge does not verify the endpoint.