Calendly webhook (public, signed)
POST/api/hooks/calendly/:token
One url per connected Calendly account (doc 94 R2). Trust is
Calendly-Webhook-Signature: t=…,v1=<HMAC-SHA256> over t.body, with
the signing key we chose for the subscription; a stale (over three
minutes) or replayed signature is refused 401. invitee.created and
invitee.canceled link the invitee's e-mail to exactly one contact
(never creating one) and queue a debounced read-back of the
appointment, which feeds the reminder engine and the booking_event
trigger. An unknown token is acknowledged with 200.
Request
Responses
- 200
- 401
Accepted, or acknowledged with nothing to do.
Unsigned, stale or replayed delivery.