Heap Partner Webhooks (Data-out API)

Heap's partner webhook surface (also called the Data-out API) delivers behavioral segment membership deltas to partner-hosted HTTPS endpoints. The documented action type is segment.users.sync, which sends adds and removes for a Heap segment on a roughly four-hour cadence. Requests are signed with a Heap-Hash header containing a timestamp and HMAC-SHA256 of the body using a shared webhook secret key, and partners are expected to verify the signature and respond 200 OK to avoid retries.