Outbound webhooks
Standard Webhooks v1, every event you need.
Twelve event types. HMAC-SHA256 signed. Retried with backoff. Replay UI for the moments your endpoint flapped at 3am. Drop-in svix-libs verification.
How signing works
The Standard Webhooks v1 wire format.
Three lowercase headers per request:
webhook-id— unique event id (deduplicate on this)webhook-timestamp— unix seconds (validate within 5min tolerance)webhook-signature—v1,<base64(hmac-sha256(...))>
The signed content is {id}.{timestamp}.{body}. Multi-secret rotation supported (multiple v1,... values space-separated).
POST /webhooks/cobalz HTTP/1.1
content-type: application/json
webhook-id: 7f2a3c0b-...
webhook-timestamp: 1745089234
webhook-signature: v1,kS9HzC3F0u1WJ2X0+dvL...
{
"id": "7f2a3c0b-...",
"type": "commission.approved",
"created_at": "2026-04-19T14:00:34Z",
"merchant_id": "abc-...",
"data": {
"commission_id": "...",
"affiliate_id": "...",
"amount": 12.50,
"currency": "USD"
}
}Reliability
What happens when your endpoint goes down.
- Yes 2xx → succeeded, last_success_at stamped, consecutive_failures reset
- Yes 410 Gone → endpoint auto-disabled, all pending deliveries dead-lettered
- Yes Other 4xx → permanent client error, dead-letter immediately (don't retry your bug)
- Yes 429 / 5xx → schedule retry with backoff, Retry-After honored
- Yes 10 attempts max → dead-letter. Backoff: 5s · 5m · 30m · 2h · 5h · 10h · 14h · 20h · 24h
- Yes Auto-disable after consecutive_failures threshold (configurable, default 15)
- Yes Last-100 delivery log per endpoint with per-row Replay button
- Yes Bulk replay between two timestamps for catastrophic recovery
Webhook integration that doesn't lose data.
Standard Webhooks v1 + replay UI on every plan that includes outbound webhooks.