Webhook Delivery Service · View 02 of 20 · Context and scope
The shape
- Accept and acknowledge on durability, before anything is known about who is subscribed. Intake latency is therefore independent of subscription count (ADR-01).
- Fan out afterwards, on the platform's own time, turning one event into N independent units of work.
- Isolate each unit in its endpoint's own queue — the decision the rest of the set exists to honour (ADR-02).
- Deliver through a dedicated egress path with a published address range, so a customer can allowlist it (ADR-11).
Why the two loop-backs
- Exhausted deliveries go to a dead-letter store rather than disappearing, and the owner is told at the first one, not the hundredth (ADR-09).
- Replay re-enqueues onto the same per-endpoint queue with the same idempotency key, so the consumer's deduplication still protects them (ADR-10).
Risks
- The fan-out stage is the one place where a single event can become 250 units of work; a tenant fan-out budget bounds it, and the budget is a guess until there is telemetry.
- Payload storage at 30 days' retention, median 4 KB and 25,000 events/s is the dominant storage line. If p99 payload size is materially above 64 KB, the retention window is the first thing that has to give.
