The callbackUrl you pass to POST /v1/solo-accounts and POST /v1/collab-scenes is stored on the record for your own reference. It does not subscribe you to anything. Deliveries go to the endpoints registered in the portal, and only to those. If you have not registered an endpoint, you receive no events.
Each endpoint has:
Property
Rule
URL
Must be https://. URLs that resolve to a private or internal address are rejected at registration and again at delivery time.
Signing secret
Generated per endpoint and prefixed whsec_. Never shared across endpoints, so you can rotate one integration without touching another.
Event subscription
A list of event types, or * for everything.
Limit
5 endpoints per partner.
The portal's test button fires a real signed test.ping delivery at the endpoint, so you can prove your signature check works before any live traffic depends on it.
t=<unix seconds>,v1=<hmac hex>. Verify it before you trust the body.
X-EZ2257-Event
The event type, so you can route to a handler without parsing the body first.
X-EZ2257-Delivery
An opaque id for this delivery, prefixed del_. Treat it as a log correlation handle only โ deduplicate on event.id, not on this. Portal test pings send the literal del_test.
The creator has both paid and passed ID verification, or an already-active account is re-provisioned, or a lapsed subscription renews. This is the signal to unlock uploads.