@putty I’ve been looking into Workflows. Until/unless the badge events include usernames (and maybe regardless, since I can use filters in Workflows to only POST the changes my service needs to hear), this looks like a great alternative option! Thanks again!
With webhooks, there’s a X-Discourse-Event-Signature with an HMAC-SHA256 signature of the payload using a secret that allows me to verify the sender. Any chance there’s a way to sign HTTP requests (POSTs) from Workflows? Maybe I just haven’t found it yet. I was hoping there’d be a setting like “Sign request using secret” that I could toggle on & provide a secret. The closest I’ve seen is adding a header_auth credential to send a secret in a header (e.g., X-Discourse-Event-Secret: Discourse Rocks!). That’s better than nothing, but a signature using a secret (not sending the secret itself) would be preferable.