Webhook Event Delivery with Retry and Signature Verification

Given a webhook endpoint registered for invoice.created events

when an invoice is created, then Rivane enqueues a signed delivery within 5 s, POSTs with Rivane-Signature and Rivane-Delivery-Id headers, and on non-2xx response retries with exponential backoff (1 min, 5 min, 30 min, 2 h, 24 h

payload is idempotent - includes event_id for deduplication by receiver

Developer registers a webhook endpoint URL and selects event types (e.g., invoice.created, payment.posted, bank_transfer.completed). When a matching event occurs, Rivane enqueues a webhook delivery job. The worker signs the payload with HMAC-SHA256 using a per-endpoint secret and POSTs to the URL with Rivane-Signature and Rivane-Delivery-Id headers. On non-2xx response or timeout, the worker retries with exponential backoff (5 attempts over 24 h). Delivery attempts (status code, latency, error) are logged and visible in the developer portal. Undeliverable webhooks after exhausting retries trigger an alert to the developer.

HMAC-SHA256 signature per delivery using a per-endpoint rotating secret;
delivery attempt log retained 30 days;
retry schedule: 1 min, 5 min, 30 min, 2 h, 24 h (configurable);
manual re-delivery available from the portal for any event within 72 h;
payload is idempotent - includes event_id for deduplication by receiver;
webhook endpoint verified via challenge-response on registration;
delivery throughput ≥10,000 events/min at p99 ≤5 s end-to-end latency;
circuit breaker disables endpoint after 50 consecutive failures.

Given a webhook endpoint registered for invoice.created events;
when an invoice is created, then Rivane enqueues a signed delivery within 5 s, POSTs with Rivane-Signature and Rivane-Delivery-Id headers, and on non-2xx response retries with exponential backoff (1 min, 5 min, 30 min, 2 h, 24 h);
when 50 consecutive deliveries fail, the endpoint is circuit-broken and the developer alerted;
(negative) when a developer registers an endpoint without completing the challenge-response verification, then the endpoint status remains UNVERIFIED and no events are delivered.

webhook_endpoint { endpoint_id: string, org_id: string, url: string, secret_hash: string, event_types: string[], status: enum(ACTIVE,UNVERIFIED,CIRCUIT_BROKEN), external_id: string };
webhook_delivery { delivery_id: string, endpoint_id: string, event_id: string, event_type: string, payload_hash: string, attempt_count: int, last_status_code: int, last_attempted_at: timestamp, status: enum(PENDING,DELIVERED,FAILED,RETRYING) };
(reference, product may differ).

POST /v1/webhook-endpoints { url, event_types[], secret } -> 201 { endpoint_id, challenge };
POST /v1/webhook-endpoints/{id}/verify { challenge_response } -> 200;
GET /v1/webhook-endpoints/{id}/deliveries;
POST /v1/webhook-deliveries/{id}/redeliver -> 202;
emits webhook.delivery_failed alert after exhausting retries;
idempotent via event_id in payload.

UNVERIFIED -> ACTIVE;
degraded CIRCUIT_BROKEN;
terminal DISABLED;
guard: endpoint must complete challenge-response before receiving events;
circuit breaker after 50 consecutive failures;
manual redeliver available within 72 h.