Skip to content
Docs

Command palette

Jump to a page or view, or find a todo by name.

Changelog

Webhooks and notifications

Durable outboxes own delivery and retries across interruptions.

Markdown

Outbound webhooks

An Endpoint belongs to a User, not an Organization: it receives the signals of every Organization the User is a Member of. Endpoint registration, rotation, update, deletion, the test delivery and the deliveries list are webhooks.service.ts programs behind webhooks.procedures.ts (mounted as integrations.webhook), with their failures in webhooks.errors.ts.

Webhook creation and delivery are separate. Domain changes record durable payloads through webhooks.events.ts, and webhooks.delivery.ts owns the rest: it claims rows with a lease before making an attempt, signs the payload, applies bounded transport and SSRF checks, then settles delivery and endpoint health together under the current lease. The cron round evaluates the time-based triggers for a batch of Endpoints with one INSERT … SELECT per trigger over the Endpoints' current Member rows.

A webhook POST receives one attempt per round. Persistent policy decides when to retry. Respect Retry-After without making a request hold the whole cron tick indefinitely. Test a lost response and expired lease; a network timeout does not prove that the receiver rejected the event.

Push reminders

The notification outbox records reminder work. Expo push sending and receipt reads have different retry semantics: receipt GETs can use the idempotent read helper. Enrollment, foreground presentation and tap responses each validate current User/Organization scope.

Mobile suppresses unauthorized or stale presentation and navigates only to a fixed authorized destination. Cancelling a local listener cannot recall a notification already displayed by the operating system.

Extend

Add event contracts to the existing event definitions and enqueue work in the domain transaction. Keep secrets and private payloads out of logs. Test duplicate delivery, lease fencing, disabled configuration and identity transitions. Device and provider delivery need separate verification from the local transport suite.

Key files

Edit on GitHubDocumentation is in English.