Integration & APIsDecision memoUpdated 2026-02-20

High-Volume Webhook Dispatch

A massively resilient, asynchronous, event-driven Webhook dispatcher enabling secure, instantaneous data synchronization with immense external APIs.

Buyer-readyFounder-grade detailCommercial

Modern enterprise systems must communicate. Instead of forcing clients to aggressively poll your REST API, SCRIPE includes a native, massively efficient outbound Webhook dispatcher. Push critical domain events instantly to any external system securely over HTTPS.

Globally Broadcast Supported Events

EventTriggerPayload
user.createdNew user registrationUser details, tenant, role
user.updatedUser profile changeChanged fields, before/after
user.deletedUser soft-deletedUser ID, tenant, timestamp
tenant.createdNew tenant provisionedTenant settings, parent
tenant.deactivatedTenant suspendedTenant ID, reason, timestamp
role.permissions.changedPermission assignmentRole, added/removed permissions
entity.created/updated/deletedAny entity CRUDEntity type, ID, changes
auth.login.failedFailed login attemptEmail, IP, attempt count

HMAC Cryptographic Signatures

Every outbound payload is securely signed using an HMAC-SHA256 signature generated from the tenant's secret key. Third-party integrations can definitively verify that the webhook originated from your SCRIPE servers and the payload was not intercepted or mutated globally.

Webhook Delivery SecurityText
POST /your-webhook-endpoint HTTP/1.1
Content-Type: application/json
X-Webhook-Signature: sha256=abc123...
X-Webhook-Id: evt_abc123
X-Webhook-Timestamp: 2026-02-20T12:00:00Z

{
  "event": "user.created",
  "timestamp": "2026-02-20T12:00:00Z",
  "tenantId": "tenant_123",
  "data": { ... }
}

// Verify: HMAC-SHA256(secret, body) == X-Webhook-Signature

Exponential Persistent Backoff

If a subscriber's server goes offline, SCRIPE does not discard the payload. Utilizing an intelligent, exponentially backed-off persistent outbox pattern, it mathematically retries the request (e.g., 5 seconds, 1 minute, 1 hour, 1 day) until receipt is confirmed via an HTTP 2xx status.

AttemptDelayTimeout
1stImmediate30 seconds
2nd1 minute30 seconds
3rd5 minutes30 seconds
4th30 minutes30 seconds
5th2 hours30 seconds
6th (final)12 hours30 seconds

Forensic Dispatch Auditing

Log FieldDescription
Event IDUnique identifier for the webhook delivery
StatusPending, Delivered, Failed, Retrying
HTTP StatusResponse code from your endpoint
DurationTime taken for delivery (ms)
Attempt #Current retry attempt number
Response BodyFirst 500 chars of response (for debugging)

Dynamic Subscription Management

MethodEndpointDescriptionAuth
GET/api/webhooksList subscriptions🔒 Required
POST/api/webhooksCreate subscription🔒 Required
PUT/api/webhooks/{id}Update subscription🔒 Required
DELETE/api/webhooks/{id}Delete subscription🔒 Required
POST/api/webhooks/{id}/testSend test event🔒 Required
GET/api/webhooks/{id}/logsView delivery logs🔒 Required
PreviousThe RESTful SurfaceNextResilient Email Infrastructure