Webhook
An HTTP callback from a provider to a consumer-supplied URL when an event occurs, replacing polling with push.
Simple to describe and routinely got wrong in four specific ways.
Verification: the receiver must be able to prove the call came from the provider, which means a signature over the payload with a shared secret, not an unauthenticated POST. Idempotency: webhooks are at-least-once, so the same event will arrive twice and the handler must tolerate it. Ordering: they arrive out of order, so the payload needs a sequence number or timestamp the handler can use. Availability: the receiver's downtime becomes the provider's retry queue, so the endpoint should accept fast, enqueue, and process asynchronously.
Getting these four right turns webhooks from a source of intermittent data corruption into a sound integration mechanism.