Overview
Webhooks
Section titled “Webhooks”Outbound webhook endpoints and their delivery log. Aether POSTs a JSON event envelope to every subscribed endpoint:
{"id": "<event UUID>", "type": "<event type>",
"created_at": "<RFC 3339>", "org_id": "<org UUID>", "data": {...}}Each delivery carries the headers X-Aether-Event (event type),
X-Aether-Event-Id (event UUID, shared across endpoints receiving the
same event), X-Aether-Delivery (delivery UUID), X-Aether-Timestamp
(unix seconds), and X-Aether-Signature with the value
v1=<hex(HMAC-SHA256(secret, "<timestamp>.<raw body>"))> — verify by
recomputing the HMAC with the stored secret over the timestamp, a .,
and the raw request body, and reject stale timestamps (replay
resistance).
A 2xx response marks the delivery succeeded. Anything else (non-2xx,
timeout, connection error) is retried on a fixed backoff schedule — waits
of 2m, 10m, 30m, 2h, 6h, 12h, and 24h between 8 total attempts (≈ 2
days) — after which the delivery is marked dead. Redirects are not
followed. Delivery is at-least-once: consumers must deduplicate on
X-Aether-Event-Id.
Endpoint URLs must be https, without embedded credentials, and must not
point at private, loopback, or otherwise internal address ranges.