X_WEBHOOK_EVENT_INVALID

the event cannot be signed as declared

an id or a topic that would make the canonical string ambiguous: outside 1–200 characters, or carrying a : or a control character. Refused BEFORE the mac is taken, because a mac over an ambiguous string is a valid signature for a delivery the sender did not write — over v1:<t>:<id>:<topic>:<body>, id evt:01HZ with topic orders.paid and id evt with topic 01HZ:orders.paid are the same bytes

change how your app mints the field cause names — the separator can never appear in either, so the edit is at the mint site and not at the send