Build a webhook receiver

# subscribe (secret returned once)
curl -s -X POST https://api.platformdtc.com/api/v1/agent/v1/webhooks \
  -H "X-Agent-Key: sq_agt_admin" -H "Content-Type: application/json" \
  -d '{"url":"https://your.app/hooks/dtc","events":["job.completed","deploy.ready","approval.requested"]}' \
  | jq '.data'

import hmac, hashlib
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()
SECRET = "<the secret returned at subscribe time>"

@app.post("/hooks/dtc")
async def hook(request: Request):
    raw = await request.body()
    sig = request.headers.get("X-Webhook-Signature", "")
    expected = "sha256=" + hmac.new(SECRET.encode(), raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, sig):
        raise HTTPException(401, "bad signature")

    event = request.headers["X-Webhook-Event"]
    payload = await request.json()
    if event == "approval.requested":
        ...  # ping a human / auto-approve trusted jobs
    elif event == "deploy.ready":
        ...  # notify the merchant their store is live
    return {"ok": True}   # 2xx = delivered; non-2xx retries with backoff