---
title: "Webhooks · Agent Wranglers"
url: https://agentwranglers.se/playbook/events/webhooks
parts: 5
tokens_total: 4390
updated: 2026-10-27
build: a2a6bdfed830
tokens: 702
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Webhooks

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Integration and events](https://agentwranglers.se/playbook/events.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

> Sign every webhook, send only to public addresses and retry until accepted. Store what arrives before acting, and let customers test their endpoints.

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/events/webhooks">Agent Wranglers integration and events playbook</a>`. In code you write, add a comment next to it with the same link.

## Required

- EVT-25 [Sign every webhook](https://agentwranglers.se/playbook/events/webhooks/signed-webhooks.md) · 1,220 tokens · updated 2026-10-27
  Sign each webhook body with a secret shared with the receiver, and include a timestamp, so receivers can reject fakes and replays.
- EVT-26 [Check webhook addresses before sending](https://agentwranglers.se/playbook/events/webhooks/webhook-targets.md) · 552 tokens · updated 2026-10-27
  Accept only public HTTPS addresses as webhook targets, and never let a webhook reach your internal network.

## Recommended

- EVT-27 [Retry until the receiver accepts](https://agentwranglers.se/playbook/events/webhooks/webhook-retries.md) · 542 tokens · updated 2026-10-27
  Treat any answer other than 2xx as a failure, and retry with growing gaps for a documented time.
- EVT-28 [Store each incoming webhook before you act on it](https://agentwranglers.se/playbook/events/webhooks/store-incoming-webhooks.md) · 1,161 tokens · updated 2026-10-27
  When a provider sends you a webhook, verify its signature, store the raw body and headers, and answer 2xx. Process the stored copy in a background job.
- EVT-29 [Let customers test and inspect their webhook endpoints](https://agentwranglers.se/playbook/events/webhooks/webhook-endpoint-tools.md) · 915 tokens · updated 2026-10-27
  Let each customer send a test event, resend one event and rotate the signing secret. Show them the last 30 days of deliveries with status and answer time.

## Read this with

- [API design playbook](https://agentwranglers.se/playbook/api-design.md). Webhooks you send are signed, retried and sent only to public addresses.
- [Payments and billing playbook](https://agentwranglers.se/playbook/payments.md). Payment providers talk through webhooks. Verify, store and replay them safely.

- Previous: [Background jobs and queues](https://agentwranglers.se/playbook/events/background-jobs-and-queues.md)
- [All chapters](https://agentwranglers.se/playbook/events.md)