semitexa / webhooks

2026.10.08.0620 2026-10-08 09:19 UTC

Requires

• php: ^8.4
• semitexa/core: *
• semitexa/orm: >=2026.09.19.1020 || dev-master

Requires (Dev)

• semitexa/testing: *

MIT

• Semitexa

• inbound
• webhooks
• outbound
• semitexa
• signature-verification

Published on Packagist.org on 2026-10-08 18:17 UTC

README

Webhook support for Semitexa — inbound signature verification with deduplication, outbound durable delivery with retries, audit trail, and replay CLI.

Install

Included in every project created by the installer (https://semitexa.com/install.sh).

Features

• Inbound: signature verification (HMAC-SHA256), durable inbox with deduplication
• Outbound: persistent outbox, claim-and-lease worker, exponential backoff retries
• Audit: append-only attempt history for all transitions
• CLI: webhook:work, webhook:replay:inbound, webhook:replay:outbound, webhook:show, webhook:cleanup

Worker

Outbound deliveries are sent by a long-running worker that does not start with the web server:

bin/semitexa webhook:work [worker-id] [poll-interval]   # poll-interval defaults to 5 seconds

Outbound targets

A delivery is only sent to an http(s) URL whose host resolves exclusively to public addresses. Loopback, private and link-local ranges (including the cloud metadata address 169.254.169.254) are refused, and cURL connects to the exact address that was checked, so a DNS answer cannot change in between. A refused target fails the attempt with the reason in the attempt history.

To deliver to a receiver on a private network, typically in development, set WEBHOOK_ALLOW_PRIVATE_TARGETS=true.