webhook

Push instead of poll: register one https URL and the daily managed run POSTs this account's rank drops there (JSON {event, accountId, sentAt, tracked, drops[]} where each drop carries appId, keyword, country, previous, rank, change), signed with HMAC-SHA256 over the raw body in the x-openaso-signature header ("sha256=<hex>"). action=set stores the URL and returns the signing secret ONCE (re-setting mints a new one); action=get shows the URL and the last delivery outcome; action=test posts a sample payload now and reports the response; action=remove deletes it. Only fires when something actually dropped. Public https hostnames only.

{
  "name": "webhook",
  "arguments": {
    "action": "get"
  }
}