A hospital runs Catalyst Center with an outbound event webhook to a Python Flask receiver for switch-down alerts. The receiver logs 401 errors, drops duplicate events during flaps, and must acknowledge within seconds while queuing heavy work. The team sees delayed retries and missing severity fields. Which webhook payload handling behavior should the receiver script implement to process Catalyst Center events reliably?

The reliable behavior is to validate each incoming payload, return HTTP 200 promptly, and queue expensive enrichment. Deduplicating with eventId lets the receiver recognize repeat deliveries of the same event, which matters during switch flaps and retry behavior. Validation also helps detect or safely handle missing fields such as severity rather than letting incomplete data pass unnoticed. A receiver that authenticates the sender, acknowledges quickly, queues enrichment, and deduplicates by eventId still lacks schema validation, so malformed or incomplete fields can enter processing unnoticed. Using event timestamps instead of eventId is unreliable: distinct events can share timestamps, and repeat deliveries may not have identical timestamp representations, leading to inaccurate duplicate suppression. Enriching severity synchronously before queuing can delay the acknowledgement; if that work is slow, the request may exceed the acknowledgement window and trigger retries. Exam caveat: a successful HTTP response acknowledges receipt, not completion of downstream work, and webhook delivery may be retried. Practical check: replay a valid event with the same eventId, submit a payload missing severity, and simulate slow enrichment; verify prompt acknowledgements, one downstream action per event, and deliberate handling of the missing field.