Tines

In obserae: create a Webhook output with a signing secret. There is no Tines output type, and none is needed.

1. Webhook action. Create one, copy its URL into an obserae Webhook output with a signing secret.
2. Verify before anything else. An Event Transform running HMAC_SHA256(secret, timestamp + "." + raw_body), compared against X-Obserae-Signature. Tines gives you the raw body on the webhook event — use it, not a re-serialised copy.
3. HTTP Request action to POST /api/policy/check, Authorization: Bearer from a Tines credential. Body: {"src": "<<webhook.body.matches.records[0].client_ip>>", …}.
4. Trigger action on covered = false → your ticketing action, keyed on dedup_key.

Tines re-emits on retry, so deduplicate on X-Obserae-Delivery before the ticket step, not after.