Webhook Delivery Service · View 08 of 20 · Structure
The contracts
- `POST /v1/events` from product services: size-capped, acknowledged on durability, never blocked on subscription state.
- The signed HTTPS POST to a customer endpoint is the platform's public interface, and so is the canonical signed string. Changing either is a breaking change for 40,000 consumers (ADR-06).
- So is the egress address range. It is versioned, reviewed and published, with change lead time, exactly like an API (ADR-11).
Not drawn here
- The replay API (view 14), audit export to a tenant's SIEM (view 20), and the observability path (view 17). Three nodes a side keeps the fan legible.
Assumptions
- Failure notification goes through the product's existing notification service rather than a channel this platform owns. That is a dependency on something outside the delivery boundary, which is acceptable because it is not on the delivery path.
