polytomic-webhooks

Polytomic Webhooks

Polytomic (polytomic.com) is a data-movement platform — models, Model Syncs and Bulk Syncs that move data between warehouses, SaaS apps and databases (reverse ETL). Its one outbound-HTTP surface is the Webhook connection used as a sync destination: you add a Webhook connection, point a Model Sync at it, and Polytomic POSTs batches of changed records to your URL on the sync's schedule.

Frame this as "receive Polytomic sync record batches", not "subscribe to Polytomic events." There is no event-subscription UI, no per-event-type toggles and no separate platform-events API. Polytomic is not an event producer in the usual sense.

Three things make Polytomic unlike most providers in this repo:

1. There is no signature. No HMAC, no digest, no signing secret. The only authentication is a static shared bearer token in the Authorization header, matching the Secret shown during connection setup. Verbatim from the docs: "This should be a 'Bearer' token matching the same value that was provided as the 'Secret' during connection setup. For now, this is the only request authorization and is a static value."
2. Polytomic-Signature-Timestamp is NOT a signature, despite the name. It carries only an RFC 3339 / ISO 8601 UTC timestamp (2021-06-01T22:55:36Z) — not a Unix epoch integer and not a digest. Parse it with new Date(value) / datetime.fromisoformat, never parseInt.
3. Every payload is a batch. object.records is "a list of the records changed since the last payload" — default batch size 100, and user-configurable. Every handler must loop. Never assume one record.

When to Use This Skill

• How do I receive Polytomic webhooks?
• How do I verify a Polytomic webhook signature? (You can't — there is none. Compare the bearer token instead.)
• What do I do with the Polytomic-Signature-Timestamp header? (Freshness only — it is not a signature.)
• Should I HMAC the timestamp plus the body? (No. There is nothing to compare an HMAC against.)
• Is the Authorization bearer token a JWT I should verify? (No — treat it as an opaque secret and compare byte-for-byte.)
• Which Polytomic webhook event types exist? (Exactly one: sync.records.)
• How do I loop over object.records[] and use hash for deduplication?
• Why are the keys inside fields different from the docs' example? (They are defined by your sync configuration.)
• Why did my Polytomic sync show as failed? (Your endpoint returned 4xx/5xx.)
• Why was my first webhook batch enormous? (The first sync run backfills everything.)