Subscribe to updates

Return the same challenge value as JSON to verify your endpoint. Updates use HMAC SHA-256: sign the timestamp, a dot and the exact body. Check X-Giov-Signature, reject old timestamps, and deduplicate X-Giov-Event-Id.

POST {"type":"subscription.confirmation","challenge":"…"}
200 {"challenge":"…"}