Payload and signature
POST your-url
X-Resets-Event: reset (or test)
X-Resets-Signature: t=<unix>,v1=<hex>
{"event":"reset","id":"2048997818673537399",
"provider":"openai","product":"Codex",
"plan":"All paid plans","scope":"",
"when":"now","summary":"Codex rate limits reset…",
"source_url":"https://x.com/…","account":"thsottiaux",
"posted_at":"2026-04-28T05:28:43Z", …}
v1 = HMAC-SHA256(secret, t + "." + raw body), hex. Reject if t is older than 5 minutes. Retries back off over ~3 hours; 5 failed deliveries in a row pause the subscription.