Installation Webhooks

Subscriptions bind an active installation, app version, tenant/store, environment, and event allowlist. Revoked or suspended installations and expired legal consent stop new deliveries.

Requests carry:

x-ayalink-event-id: <stable-id>
x-ayalink-timestamp: <unix-seconds>
x-ayalink-signature: v1=<hex-hmac-sha256>

Compute HMAC-SHA256 over <timestamp>.<raw-body>, compare in constant time, reject timestamps outside the permitted window, then atomically consume the event ID. Parse JSON only after signature verification. See the verification example.

Secret creation and rotation reveal plaintext once. During the documented transition window, receivers may verify the current and previous key; after revocation the old key fails. Never persist signatures, raw request/response bodies, URL query secrets, tokens, or unnecessary PII in delivery logs.

Worker delivery uses leases, bounded exponential backoff with jitter, Retry-After, dead-letter, and safe manual replay. Replay creates a new delivery attempt within the same installation while preserving the original event ID, so the receiver's business effect remains idempotent.