semitexa / webhooks
Semitexa Webhooks - inbound verification/deduplication and outbound durable delivery with retries
Package info
github.com/semitexa/semitexa-webhooks
Type:semitexa-module
pkg:composer/semitexa/webhooks
Requires
- php: ^8.4
- semitexa/core: *
- semitexa/orm: >=2026.09.19.1020 || dev-master
Requires (Dev)
Suggests
None
Provides
None
Conflicts
None
Replaces
None
- dev-master
- 2026.09.28.0444
- 2026.09.27.0404
- 2026.09.23.1717
- 2026.09.19.1020
- 2026.09.11.0529
- 2026.09.08.2003
- 2026.08.21.0628
- 2026.08.19.1426
- 2026.08.04.2028
- 2026.07.25.0821
- 2026.07.06.1438
- 2026.06.21.0352
- 2026.05.08.1640
- 2026.04.26.0639
- 2026.04.15.0921
- 2026.04.14.1121
- 2026.04.13.0911
- 2026.04.12.1209
- 2026.04.05.0855
- 2026.04.03.1349
- 2026.04.03.1240
- 0.1.3
- v0.1.2
- dev-develop
This package is auto-updated.
Last update: 2026-09-28 05:03:02 UTC
README
Webhook support for Semitexa — inbound signature verification with deduplication, outbound durable delivery with retries, audit trail, and replay CLI.
Phase 1
- Inbound: signature verification (HMAC-SHA256), durable inbox with deduplication
- Outbound: persistent outbox, claim-and-lease worker, exponential backoff retries
- Audit: append-only attempt history for all transitions
- CLI:
webhook:work,webhook:replay:inbound,webhook:replay:outbound,webhook:show
Outbound targets
A delivery is only sent to an http(s) URL whose host resolves exclusively to public addresses. Loopback, private and link-local ranges (including the cloud metadata address 169.254.169.254) are refused, and cURL connects to the exact address that was checked, so a DNS answer cannot change in between. A refused target fails the attempt with the reason in the attempt history.
To deliver to a receiver on a private network, typically in development, set WEBHOOK_ALLOW_PRIVATE_TARGETS=true.