A webhook is an automated HTTP message one system sends to another when a defined event occurs. It allows the receiving application to react without repeatedly polling for updates.
How does a webhook work?
A source system records an event, builds a payload and sends it to a registered endpoint. The destination validates the request, records the event and returns an acknowledgement.
Webhook vs. API request
An API request is usually initiated by the application seeking data or an action. A webhook is initiated by the source system when an event occurs. Many integrations use both.
Which controls are required?
- HTTPS endpoint
- Signature or message authentication
- Timestamp and replay protection
- Idempotent event processing
- Restricted logging
- Retry and dead-letter handling
Why can events arrive more than once?
Providers retry when acknowledgements fail or time out. Store stable event IDs and make processing safe to repeat rather than assuming exactly-once delivery.
How should event order be handled?
Use event timestamps, versions and authoritative state checks. Do not let a delayed older event overwrite a newer transaction status.
