Webhooks
Deliver signed at-least-once events between independently operated systems.
Problem
A consumer needs changes without polling continuously.
When to use it
- Consumers expose stable HTTPS endpoints
- Delivery can be asynchronous
When not to use it
- Immediate command response is required
- Sensitive payload cannot be minimized
Minimal example
Sign timestamp + raw body; unique event id; retry 2xx failures with jitter; expose replay UI.
Tradeoffs
- Duplicates, reordering, and endpoint outages
- Secret rotation and SSRF-safe registration matter