Webhooks

In the pipeline builder, add a Webhook step with:

• URL: must start with https:// and be publicly reachable. Private and internal addresses are refused, and redirects are not followed.
• Shared secret: the request body is signed with HMAC-SHA256 in the x-humaneq-signature header.
• Wait for a reply up to a number of minutes (60 by default).

A POST with JSON containing the event, your organization, the role, the application (reference, stage, candidate name and email, applied date, tags and source), the step, the scores, the call facts and the form answers, plus a callbackUrl and callbackToken.

• Reply at once with a 2xx and {"port": "yes"}, "no" or "other". The candidate follows that outcome.
• Or reply 202 and decide later: POST {callbackToken, port} to the callback URL, signed the same way. Meanwhile the candidate waits.

A request that fails or takes longer than 20 seconds follows the Error outcome and flags the application webhook failed. No reply before the deadline follows No reply in time.