Plug MonitorHQ into what you already use

Example payload

{
  "event": "change_detected",
  "entity_name": "ACME PTY LTD",
  "acn": "123456789",
  "abn": null,
  "events": [
    {
      "title": "Document Lodged",
      "description": "Change of registered address",
      "event_type": "document_lodged",
      "effective_date": "2026-08-16",
      "source": "asic",
      "metadata": null
    }
  ],
  "detected_at": "2026-08-16T04:12:00+00:00"
}

Verifying the signature

Every request carries an X-Monitorhq-Signature header in the form t={timestamp},v1={hmac}, computed as HMAC-SHA256 of {timestamp}.{body} using your webhook secret.

[$timestamp, $hmac] = sscanf(
    $_SERVER['HTTP_X_MONITORHQ_SIGNATURE'],
    't=%d,v1=%s'
);

$expected = hash_hmac(
    'sha256',
    $timestamp . '.' . $rawBody,
    $webhookSecret
);

$valid = hash_equals($expected, $hmac);

const [, timestamp, hmac] = /^t=(\d+),v1=(.+)$/.exec(
    req.headers['x-monitorhq-signature']
);

const expected = crypto
    .createHmac('sha256', webhookSecret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

const valid = crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(hmac)
);

import hmac, hashlib, re

match = re.match(r"t=(\d+),v1=(.+)", request.headers["X-Monitorhq-Signature"])
timestamp, signature = match.group(1), match.group(2)

expected = hmac.new(
    webhook_secret.encode(),
    f"{timestamp}.{raw_body}".encode(),
    hashlib.sha256,
).hexdigest()

valid = hmac.compare_digest(expected, signature)