From the Webhooks page in your Customer Portal, register an HTTPS endpoint you control. WHA Shield signs every delivery with an HMAC signature over the raw request body, using a secret shown once when you create the webhook.
To verify a delivery, compute an HMAC-SHA256 signature of the raw request body using your webhook secret and compare it, using a constant-time comparison, against the signature header WHA Shield sends. Never trust a webhook payload without verifying this signature first.
If your endpoint does not return a successful HTTP status, WHA Shield retries the delivery with backoff. You can see the delivery history and retry status for each webhook from the Webhooks page.