Webhooks

Endpoints subscribe to job.queued, job.succeeded, job.failed, job.cancelled. The signing secret is returned once. Deliveries are at least once. Deduplicate with X-Webhook-Event-Id.

The signature header is X-Webhook-Signature: t=<unix>,v1=<hex hmac>. The HMAC-SHA256 input is timestamp.eventId.body using the raw body. Reject timestamps older than five minutes in your receiver. Redirects are not followed. Private and link-local addresses are rejected. Production URLs must be HTTPS.

DNS rebinding is reduced by resolving the host before delivery and refusing private answers. It is not fully eliminated.