Consent decisions were recorded

Counts and record ids, never visitor data.

Verifying a delivery. Every POST carries X-TagSentry-Signature: t=<unix seconds>,v1=<hex>, where v1 is the HMAC-SHA256, keyed with the endpoint's secret (whsec_…, shown once when the endpoint is added), of the string t + "." + rawBody: the timestamp, a full stop, then the body EXACTLY as received, before any JSON parsing. Compare in constant time and refuse a t more than 300 seconds from your clock.

const crypto = require("node:crypto");
function verify(secret, header, rawBody, nowSeconds = Math.floor(Date.now() / 1000)) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!Number.isInteger(t) || Math.abs(nowSeconds - t) > 300) return false;
  const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest();
  const given = Buffer.from(parts.v1 ?? "", "hex");
  return given.length === expected.length && crypto.timingSafeEqual(given, expected);
}

X-TagSentry-Event names the event; X-TagSentry-Delivery is the delivery id, stable across retries. Answer 2xx within 10 seconds. A timeout, 408, 429 or 5xx is retried with backoff, 8 tries in all; any other answer, and a redirect, fails at once. We never follow redirects.