Webhooks

Stub. Final payload shapes pending; this page describes the intent.

Apps subscribe to events in their manifest. Yapture POSTs each event to the configured URL with an HMAC-SHA256 signature.

Available events

Event	When it fires
`yap.created`	A yap is appended to a list the app has `yaps:read` access to.
`yap.updated`	Any field on a watched yap changes.
`yap.completed`	A yap moves to `status:done`.
`list.shared`	A list is shared with the app’s installer.

Every request includes:

X-Yapture-Signature: sha256=<hex> — HMAC-SHA256 of the raw body, keyed by the per-installation secret.
X-Yapture-Event: yap.completed
X-Yapture-Delivery: <uuid>

Up to 5 attempts on non-2xx, with exponential backoff (1m, 5m, 30m, 2h, 12h).
After 5 failed deliveries the webhook is auto-paused; the publisher gets an email.