Sume video callback_url must be HTTPS: a webhook instead of polling

Add callback_url to a Sume video request if you want a push instead of a poll. The URL must be HTTPS. Sume's webhook docs list job.completed, job.failed and job.canceled events, signed with a header in the form sume-v1=<hex> computed over the timestamp, a dot and the raw body. Failed deliveries are retried up to 10 times, 30 seconds apart.

What your receiver must do

Requests carry x-sume-webhook-signature and x-sume-webhook-timestamp headers.

• Read the raw body before any JSON parsing; the signature covers the raw bytes.
• Refuse to verify when your signing secret is empty.
• Reply 2xx quickly and do the work after.
• Treat events as at-least-once and dedupe by job id.

Webhook or poll

Job statuses are pending, in_progress, completed, failed and cancelled; a poll loop should stop on any of the last three.