# WP-52 — OpenZaak Notificaties (NRC) live status

Status: todo
Phase: 9 — OpenZaak / ZGW integration

## Why

With cases in OpenZaak, case status changes in the backoffice, not in this app. Production
"live" status needs the **Notificaties API (NRC)**: subscribe to zaak events and update on
webhook, rather than polling. Last slice of the ZGW integration arc.

## Read first

- [openzaak-integration.md](../reference/openzaak-integration.md)
- WP-49/50/51 (the read/write/document slices this builds on)

## Decisions (pre-made, don't relitigate)

- The BFF exposes a webhook endpoint that NRC calls; it validates an Authorization header the
  BFF issued, then invalidates any cached case data / notifies the FE.
- Subscription (`abonnement` on the `zaken` kanaal) is provisioning/config, not runtime code.
- FE update mechanism reuses the existing RemoteData reload — no new FE contract.

## Files

- A new BFF webhook endpoint (`POST /zgw/notificaties`) + Authorization validation.
- `ZgwOptions`: `NrcBaseUrl` + the webhook shared secret.

## Steps

1. Add the webhook endpoint (auth-checked, no PII logged — reuse the audit seam).
2. On a zaak event, invalidate cache / push an update to the FE.
3. Document the `abonnement` provisioning (out-of-band, one-time).

## Acceptance criteria

- [ ] A posted NRC event (correct auth) triggers a case refresh; a bad-auth post is rejected.
- [ ] No PII in the webhook logs.
- [ ] Tests cover auth accept/reject + the refresh trigger.

## Verification

`dotnet test`; against a docker OpenZaak + NRC if available.

## Out of scope

Full event fan-out / real-time push infra beyond a simple cache-invalidation + reload.

## Risks

Webhook must be reachable from NRC in prod (network/ingress) — a deployment concern, not code.