An Event Grid webhook delivers to an HTTPS endpoint that rejects calls lacking an Authorization header with a bearer token. You need that header on every delivery, with the token kept out of the URL. What should you do?
Show answer and explanation
Answer: C
Event Grid webhook subscriptions support custom headers, so you can define an Authorization header carrying the bearer value on the subscription. Event Grid includes it with every delivery attempt. The token stays out of the URL and out of the event body. Query parameters expose the token in request URLs that proxies and logs may record. Placing it in the payload changes the event schema for every consumer, and the endpoint expects a header anyway.
Why the other options are wrong
- A. A query string token appears in request URLs, which proxies and gateways often log. It also does not satisfy an endpoint that reads the Authorization header.
- B. The endpoint expects a header, not a body field, so this would still fail the check. Embedding credentials in events also copies them into storage and to every consumer.
- D. Azure Relay forwards traffic between endpoints through a relay namespace. It is a heavier design than needed when the subscription can simply carry the header.