Every payload is signed. Verify the X-Famit-Signature header (HMAC-SHA256 of the raw body using your secret); the event name is also sent in X-Famit-Event.