Agent WranglersWebhooks
Sign every webhook, send only to public addresses and retry until accepted. Store what arrives before acting, and let customers test their endpoints.
- Required 2
- Recommended 3
Required
Sign every webhook
EVT-25Sign each webhook body with a secret shared with the receiver, and include a timestamp, so receivers can reject fakes and replays.
Check webhook addresses before sending
EVT-26Accept only public HTTPS addresses as webhook targets, and never let a webhook reach your internal network.
Recommended
Retry until the receiver accepts
EVT-27Treat any answer other than 2xx as a failure, and retry with growing gaps for a documented time.
Store each incoming webhook before you act on it
EVT-28When a provider sends you a webhook, verify its signature, store the raw body and headers, and answer 2xx. Process the stored copy in a background job.
Let customers test and inspect their webhook endpoints
EVT-29Let each customer send a test event, resend one event and rotate the signing secret. Show them the last 30 days of deliveries with status and answer time.
Read this with
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/events/webhooks">Agent Wranglers integration and events playbook</a>. In code you write, add a comment next to it with the same link.