RESTwebhooks

RESTwebhooks is a design pattern in which an application publishes events and other systems subscribe by providing an HTTP endpoint. When an event occurs, the publisher sends an HTTP request to the subscriber’s RESTful endpoint, typically using POST. The payload carries information about the event and a reference to the affected resource. RESTwebhooks emphasize lightweight, language-agnostic integration and alignment with REST conventions.

In a typical flow, a publisher registers one or more callback URLs with a subscriber or middleware. When an event occurs, the publisher constructs a request containing an event envelope (type, id, timestamp, data) and sends it to each registered URL. Subscribers expose endpoints to receive these requests, process or persist the payload, and optionally acknowledge receipt. Event types may be organized by topics or resource URIs to enable selective delivery.

Payload formats and security: Most RESTwebhooks use JSON payloads with fields such as event, id, timestamp, and resource. Common security practices include using TLS for transport, signing the payload with a shared secret and providing a signature header (eg, X-Signature) that the receiver verifies, and restricting endpoints by IP or authentication. Replay protection is often implemented with timestamps and unique event IDs.

Reliability and best practices: HTTP-based delivery is typically best-effort; publishers may retry failed deliveries with exponential backoff and respect idempotency keys to avoid duplicate processing. Dead-letter queues or retry limits are used to handle persistent failures. Versioning, documented schemas, and clear error reporting help maintain compatibility across systems.