Webhook Manager

• ◇GitHubrelease:publishedsucceeded1h ago

  → github.release.published · release release_38412

• ▦Shopifyorders/fulfilledsucceeded3h ago

  → shopify.order.fulfilled · order order_55234

• ◫Google WorkspacepermissionChangesucceeded3h ago

  → google.permission.granted · permission permission_81619

• ▦Shopifyproducts/updateretrying4h ago

  → shopify.product.updated · product product_26581

• ▦Shopifyproducts/createsucceeded5h ago

  → shopify.product.created · product product_48568

• ◉Stripepayment_intent.payment_failedpending8h ago

  → stripe.payment.failed · payment payment_67361

• ◉Stripecharge.refundedretrying8h ago

  → stripe.payment.refunded · payment payment_31534

• ◇GitHubpull_request_review:submittedsucceeded12h ago

  → github.pull_request.approved · pull_request pull_request_34614

5 further events received.

83/100 — 1 active endpoint uses a scheme that does not bind the credential to the body. Google OIDC bearer proves the caller holds a credential but does not bind it to the body, so a captured delivery can be replayed with altered contents. 1 further penalty applied.

Active endpoints

4

Unverified

0

Success rate

100%

Retry rate

11.1%

Queue depth

3

Dead letters

0

• −9 Weak signature schemes — 1 active endpoint uses a scheme that does not bind the credential to the body. Google OIDC bearer proves the caller holds a credential but does not bind it to the body, so a captured delivery can be replayed with altered contents.
• −8 Retry rate — 11.1% of settled events needed a retry, above the 10% threshold. The inbound path is succeeding, but not first time.

• ▦Shopifyproducts/updateattempt 3 of 6due 4h ago

  Aggressive policy · A transient fault interrupted processing. Nothing about the event is wrong.

• ◉Stripecharge.refundedattempt 1 of 6due 8h ago

  Aggressive policy · The delivery failed its signature check and was recorded rather than processed.

1. 1Endpoint identification
2. 2Signature verification
3. 3Payload validation
4. 4Tenant resolution
5. 5Normalisation
6. 6Deduplication
7. 7Queue admission
8. 8Event routing

Every inbound delivery passes all eight stages in this order before it reaches the Integration Event Bus. No external platform reaches an AI-EOS module directly.

Header parsing, prefix checking, signed-string assembly and the replay window are all real and tested. The MAC comparison itself is a port with no implementation wired — an endpoint whose signature cannot be checked is refused, not admitted.

• stripe12 events mappedstripe-v1

  Stripe posts a single envelope with `type`, `id`, `created` and a `data.object` carrying the resource. The signature covers the timestamp and the raw body together, so the body must not be re-serialised before verification.

• shopify8 events mappedshopify-hmac-sha256

  Shopify names the topic in `x-shopify-topic` and the delivery in `x-shopify-webhook-id`, with the resource itself as the whole body. The HMAC covers the body alone, so the trigger-time header bounds replay only as far as the sender is honest.

• github10 events mappedgithub-sha256

  GitHub names the coarse event in `x-github-event` and the specific action in the body, so an event type here is the pair. The delivery id in `x-github-delivery` is stable across GitHub's own redeliveries, which makes it the correct idempotency key.

• google-workspace4 events mappedgoogle-oidc

  Google push notifications are content-free: `x-goog-resource-state` names the change and `x-goog-resource-id` names the resource, with no body describing what changed. Every event here is a trigger to fetch, not a fact to file.

• slackprepared, not mappedslack-v0

  Signature verification is ready; the event map is not. Slack has no runtime plugin, so it declares no topics, and a row here would name a topic the bus cannot route. The rows arrive with the plugin.

• discordprepared, not mappeddiscord-ed25519

  Signature verification is ready; the event map is not. Discord has no runtime plugin, so it declares no topics. Its Ed25519 scheme is checked against a public key rather than a shared secret.

• webhookprepared, not mappedgeneric-hmac-sha256

  The unlisted-platform door. Accepts a signed POST from any sender the operator has configured a secret for, and maps nothing — an event arriving here is recorded and refused at validation until a manifest names its type.