Webhook Delivery Service  ·  View 20 of 20  ·  Assurance

Identity and Access

Why changing a URL needs a stronger proof than changing an event type.

Editable source SVG draw.io All views
Integration Developer Tenant Identity Console Management API Authorisation Subscription Store Audit Log 1. SSO with MFA 2. assertion, tenant scope 3. PATCH endpoint url 4. tenant, actor, action 5. URL change is elevated 6. step-up required 7. 403 + step_up_required 8. re-authenticate 9. PATCH with fresh assertion 10. write, versioned 11. actor, before, after 12. 202, effective ≤ 30 s 13. export to tenant SIEM Identity and Access — Changing an Endpoint URL Changing a URL redirects the tenant's data, so it needs a higher authority than changing which event types are sent. v 1.0 · owner Integration Platform Architecture · date 2026-09

The asymmetry

  • Changing which event types an endpoint receives is routine. Changing its URL redirects the tenant's data to somewhere new, and is authorised separately and at a higher bar (ADR-16).
  • Step-up is returned as a machine-readable `step_up_required`, not a generic 403, so an automated client can respond correctly rather than retrying into a wall.
  • Every subscription change, secret rotation, enable/disable and replay is written to an audit record independent of the delivery telemetry, and exported to the tenant's own SIEM.

Assumptions

  • Tenant SSO with MFA is the identity source; the platform holds no passwords of its own.
  • A subscription change is effective within 30 s p99; an unsubscribe or endpoint deletion within 5 s p99, because continued delivery after deletion is a data-protection incident rather than a scheduling lag.
  • Audit retention 400 days.

Risks

  • The elevated-action list is a judgement call made once and then rarely revisited. If it is drawn too narrowly, an account takeover redirects a tenant's events with a single routine-looking API call.
  • Continued delivery after a tenant deletion is the failure with the worst regulatory consequence on this platform, and it is enforced by a propagation bound rather than by a synchronous check on the delivery path.
◀  Trust Zones and the Egress Path All views
Solution Architecture v1.0 · Amazon Web Services · Integration Platform Architecture · 2026-09 · 20 views · 16 architecture decision records20-identity-and-access