Webhooks

Coming later. There is no webhook endpoint, subscription UI or delivery service in this first slice. Do not configure a callback or send a signing secret to this portal.

The future design uses a transactional outbox and at-least-once delivery. Consumers will need durable event-ID deduplication, exact-byte signature verification and replay protection. Ordering is scoped to a declared company/aggregate stream, not global. Acknowledgment means durable receipt, never that money has posted.

Callbacks will contain minimal references. Fetch data through current authorization; no payroll values, documents or operator credentials belong in event payloads. Destinations will require ownership verification and enforced SSRF/egress controls. Scope and installation authority must be rechecked on dispatch and replay.

Signed delivery, retries, replay retention and rotation will be documented with the released webhook contract. Polling and snapshot recovery remain the intended source of truth. No webhook safety, network isolation or delivery guarantee is proven by this preview.