The API, and the three tools it plugs into

The envelope, the same for all five

{
  "id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
  "type": "announcement.published",
  "occurred_at": "2026-09-01T06:00:00.000Z",
  "organization_id": "0a9b8c7d-6e5f-4a3b-8c9d-0e1f2a3b4c5d",
  "data": {
    "announcement": {
      "id": "6b1f0f1e-0c2a-4c5e-9a3d-2f5b8c7d1e40",
      "title": "Parada de la línea 3 el jueves",
      "body": "El jueves 4 a las 06:00 para la línea 3 por mantenimiento programado.",
      "kind": "news",
      "language": "es",
      "requires_acknowledgement": true,
      "audience": {
        "type": "departments",
        "names": [
          "Mantenimiento",
          "Calidad"
        ]
      },
      "community": "Planta de Getafe",
      "author": {
        "id": "3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c",
        "name": "Ana García",
        "email": "ana.garcia@empresa.com",
        "external_id": "EMP-0042"
      },
      "url": "https://app.blastack.com/inicio#post-6b1f0f1e-0c2a-4c5e-9a3d-2f5b8c7d1e40",
      "status": "published"
    }
  }
}

What is inside changes with the event; the envelope does not. The id does not change across retries, so dropping a duplicate is a one-line condition on your side.

The headers on every delivery

Verifying the signature

The signature is HMAC-SHA256 over the timestamp, a dot and the raw body, unparsed. It is the same format the payment gateways use, which means the one you have probably written once already.

import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(rawBody, headers, secret) {
  const sent = headers["blastack-signature"] ?? "";
  const t = /t=(\d+)/.exec(sent)?.[1];
  const v1 = /v1=([0-9a-f]+)/.exec(sent)?.[1];
  if (!t || !v1) return false;

  const mine = createHmac("sha256", secret)
    .update(`${t}.${rawBody}`, "utf8")
    .digest("hex");

  if (v1.length !== mine.length) return false;
  if (!timingSafeEqual(Buffer.from(v1, "hex"), Buffer.from(mine, "hex"))) {
    return false;
  }
  return Math.abs(Date.now() / 1000 - Number(t)) < 300;
}

Compare in constant time and reject anything whose timestamp is more than a few minutes old. Without that second check, a copy of an old delivery can be replayed at you for years and the signature will still verify.

Retries, pausing, and why nothing is arriving

• Any 2xx will do. We do not read the body, so answer fast and do the work afterwards: we give up after ten seconds and that counts as a failure.
• Six attempts with growing waits — a minute, five, fifteen, an hour, three and six — spread over about ten and a half hours. That covers a night deploy and a weekend maintenance window.
• Thirty consecutive failures pause the endpoint, and the reason is recorded. You bring it back by setting it active again, which also resets the counter.
• We only call public https addresses. It is checked when you register the endpoint and again before every delivery, because a name that resolves to the public internet today can resolve to your internal network tomorrow.
• An endpoint registered today does not receive yesterday's events: a subscription starts counting when it is created, so building your first scenario does not fire forty runs at once.