Webhook Delivery Service · View 18 of 20 · Operations
Decisions
- Health is per endpoint, never per tenant. A tenant with five endpoints has five independent health states, five circuits and five backlogs (ADR-02).
- An endpoint that has never once succeeded is never enabled, so the cycle cannot start in the failing half.
- Re-enable is a deliberate human action with an explicit choice — deliver the backlog, skip it, or resume from a point. Making that choice for the customer is the platform deciding how much of their history to replay into their production system (ADR-14).
- Health is recomputed from recent attempts rather than stored as truth, so a stale health record can never be why a working endpoint is not delivered to.
Assumptions
- Circuit opens at 20 consecutive failures, probes every 5 minutes, auto-disable after 72 hours with zero successes, resumption ramped over 5 minutes.
- Degraded is an observable state exposed to the owner rather than an internal one, because the point of it is to be seen before the circuit opens.
Open
- How long a backlog is held for a disabled endpoint nobody re-enables. Thirty days is assumed; the honest answer depends on how many abandoned endpoints the population actually contains, which nobody knows before launch.
