Webhooks Overview

Outbound webhook delivery with exponential retry, HMAC signatures, and dead-letter queue.

The PlatformXe Webhooks Service delivers event notifications to your application via HTTP callbacks. When an event occurs in PlatformXe (email sent, file uploaded, permission changed), a signed payload is sent to your configured endpoint.

How it works

1. You register a webhook URL and select which event types to subscribe to.
2. When a matching event fires, PlatformXe sends an HTTP POST to your URL with a signed JSON payload.
3. Your endpoint returns a 2xx status to acknowledge receipt.
4. If delivery fails, PlatformXe retries with exponential backoff.
5. After all retry attempts are exhausted, the payload moves to a dead-letter queue for manual inspection.

Key features

• Event-based subscriptions -- subscribe to specific event types, not all-or-nothing
• HMAC-SHA256 signatures -- every payload is signed so you can verify authenticity
• Exponential retry -- failed deliveries are retried up to 8 times with increasing delays
• Dead-letter queue -- undeliverable payloads are captured for manual replay
• Replay protection -- timestamp headers prevent replay attacks
• Secret auto-generation -- webhook signing secrets are generated automatically on creation

Retry schedule

Attempt	Delay
1	Immediate
2	30 seconds
3	2 minutes
4	10 minutes
5	30 minutes
6	1 hour
7	4 hours
8	12 hours

After the 8th failed attempt, the payload moves to the dead-letter queue.

API scope

All webhook management endpoints require the webhooks:manage scope on your API key.

Endpoints

Method	Path	Description
GET	/api/v1/webhooks	List all webhooks
POST	/api/v1/webhooks	Create a webhook
PATCH	/api/v1/webhooks/:id	Update a webhook
DELETE	/api/v1/webhooks/:id	Delete a webhook

Next steps

• Manage Webhooks -- create, update, and delete webhook subscriptions
• Signature Verification -- verify HMAC signatures and prevent replay attacks