# Webhooks On the Scale plan, alert matches and record changes can be delivered as signed webhooks: an HTTPS POST with a JSON body and a signature header to verify before trusting it. Compute the HMAC of the raw body with your secret and compare it to the header in constant time; reject anything older than five minutes.Checked on 2026-11-12.Official source: [RFC 2104 HMAC](https://www.rfc-editor.org/rfc/rfc2104) | Plan | Scale | | --- | --- | | Transport | HTTPS POST, JSON | | Verification | HMAC signature header | ## Verify every delivery Compute the HMAC of the raw body with your secret and compare it to the header in constant time; reject anything older than five minutes. ## Managing endpoints | Endpoint | Use | | --- | --- | | GET /api/v1/webhooks | List your webhook endpoints | | POST /api/v1/webhooks | Add an endpoint; the signing secret is shown once | | DELETE /api/v1/webhooks/{id} | Remove an endpoint | ## Related - [Alerts](https://samgovapi.io/docs/alerts) - [Pricing](https://samgovapi.io/pricing)Updated 2026-11-12. Sources checked 2026-11-12.Independent. Not affiliated with, endorsed by or sponsored by GSA, SAM.gov or any U.S. government agency. Registering in SAM.gov is free at sam.gov.

---

HTML version: https://samgovapi.io/docs/webhooks . Markdown: https://samgovapi.io/docs/webhooks.md

Independent. Not affiliated with, endorsed by or sponsored by GSA, SAM.gov or any U.S. government agency. Registering in SAM.gov is free at sam.gov.

Get a free API key: https://samgovapi.io/sign-up?ref=ai-claudebot