Authentication

Every webhook subscription declares how RCM authenticates its deliveries to your endpoint. There are two mechanisms, chosen per subscription via the auth_type field:

auth_type	How RCM authenticates	You verify by…
HMAC (default)	Signs each delivery with a per-subscription secret and sends the X-RCM-Signature header.	Recomputing the signature and comparing it. See Signature verification.
BASIC	Sends an Authorization: Basic base64(client_id:client_secret) header built from credentials you provide.	Validating the Authorization header against the agreed credentials.

Existing subscriptions default to HMAC, so nothing changes unless you opt into BASIC.

---

HMAC (default)

RCM generates a secret per subscription and signs every delivery. You verify the X-RCM-Signature header before processing the body.

• The signing secret is generated by RCM and shared with you securely out of band — it is never returned by the API.
• The signature is Base64(HMAC-SHA256(secret, timestamp + raw_body)), sent in X-RCM-Signature.

Full algorithm and copy-paste receiver snippets: Signature verification.

---

Basic auth

With BASIC, you provide the credentials and RCM authenticates itself to your endpoint with a standard HTTP Basic Authorization header on every delivery.

Create a subscription with Basic auth

Register the subscription with POST /rcm/v1/integration/webhooks, authenticating the API call with your OAuth bearer token (see Obtaining tokens). Set auth_type to BASIC and include the credentials:

curl -X POST https://sandbox.osigu.com/rcm/v1/integration/webhooks \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "webhook_url": "https://api.his-system.example.com/webhooks/rcm",
    "subscribed_event_types": [
      "DOCUMENT_VALIDATION_COMPLETED",
      "DOCUMENT_VALIDATION_REJECTED",
      "DOCUMENT_CLASSIFICATION_COMPLETED",
      "DOCUMENT_CLASSIFICATION_FAILED"
    ],
    "auth_type": "BASIC",
    "basic_auth_client_id": "your-client-id",
    "basic_auth_client_secret": "your-client-secret",
    "description": "HIS receiver (Basic auth)"
  }'

• Base URL: https://sandbox.osigu.com (sandbox) or https://api.osigu.com (production). Base path: /rcm/v1/integration/webhooks.
• basic_auth_client_id and basic_auth_client_secret are defined by you, thinking about how your endpoint will validate them. Both are required when auth_type is BASIC.
• The secret is stored encrypted at rest and is never returned when you read the subscription back (a GET shows auth_type and basic_auth_client_id, but never the secret).

The response returns the created subscription (its id, status: ACTIVE, auth_type, etc.). From then on, every delivery to your webhook_url carries the Authorization: Basic header built from these credentials.

Rotate the credentials

Update the subscription with PUT /rcm/v1/integration/webhooks/{webhookId}, sending a new basic_auth_client_secret (and/or basic_auth_client_id). Accept both the old and new credentials on your side during the cutover window, then retire the old one.

What arrives on each delivery

Every POST carries:

Authorization: Basic base64(client_id:client_secret)
Content-Type: application/json
X-RCM-Event-Type: DOCUMENT_VALIDATION_COMPLETED
X-RCM-Event-ID: 3fa85f64-5717-4562-b3fc-2c963f66afa6
X-RCM-Timestamp: 2026-06-25T15:34:00.123-06:00

Note that X-RCM-Signature is not sent for Basic subscriptions.

What you must do

1. Validate the Authorization header against the agreed credentials on every request. Reject with 401 anything that is missing or does not match.
2. Terminate TLS — Basic auth only protects the credentials if the connection is HTTPS. Your webhook_url must be https://.
3. Still be idempotent on X-RCM-Event-ID and still validate X-RCM-Timestamp skew, exactly as with HMAC.

warning

Basic auth authenticates the sender but does not protect body integrity the way an HMAC signature does. If you need tamper-evidence on the payload, prefer HMAC.

---

Choosing between HMAC and Basic

	HMAC	Basic
Who provides the secret	RCM	You
Body tamper-evidence	Yes (signature covers the body)	No
Receiver work	Recompute + compare signature	Validate Authorization header
Best when	You want the strongest integrity guarantee	Your platform already standardises on Basic auth

When in doubt, use the default (HMAC).