scout webhook OK — endpoint accepts signed POST only