Docs
Webhooks overview
Prepare secure webhook handling while the verified VartaFlow event catalogue and signature scheme are documented.
1 min read · 110 words.
The event catalogue and signature verification scheme are pending. A production consumer should use HTTPS, verify authenticity, acknowledge promptly, process asynchronously, handle duplicates and monitor failures. Never trust an event merely because it resembles an expected payload.
Consumer design
Separate receipt from business processing so slow dependencies do not delay acknowledgement. Store a bounded event identifier when the verified contract supports one, make handlers idempotent and send failed work to an observable retry or review path.
Security and operations
Reject unsupported methods and oversized requests, rotate secrets safely and avoid logging full payloads. Test duplicate, delayed, reordered and malformed events only after the official signature and event contracts are available.