A seat was booked in a session.

Sent to your registered endpoint when a booking is created. Verify the
Dwrrah-Signature header before trusting the payload: it is a
comma-separated list of v1=<hex> HMAC-SHA256 signatures over
Dwrrah-Timestamp + "." + raw_body keyed by your signing secret. Compute
your own HMAC and accept the event if it matches any v1= value —
during a secret rotation's 24h grace window the list carries both the new
and the previous secret's signature.