Webhooks, Events, and Integrations

The integrations module lets workspace systems subscribe to Slab5 operational events through signed webhook endpoints.

Status

Public capabilities includes event type discovery, workspace webhook endpoint configuration, signed outbound delivery, delivery visibility, and bounded retry state.

Public capabilities

• List system and workspace-specific integration event types.
• Register custom workspace event types for integration workflows.
• Create, list, pause, and update webhook endpoint subscriptions.
• Queue signed test deliveries for endpoint verification.
• Deliver pending and retrying webhook records to active endpoint URLs.
• Inspect delivery attempts by endpoint, event type, and status.

Webhook signing

Webhook deliveries include an x-slab5-signature header with a timestamp and HMAC-SHA256 signature. Receivers should compute the signature over the timestamp and exact JSON payload using the endpoint signing secret returned when the webhook is created.

The signature format is:

t=<unix_timestamp_seconds>,v1=<hex_hmac_sha256>

The signed value is:

<unix_timestamp_seconds>.<raw_json_body>

Outbound deliveries also include:

• x-slab5-delivery-id
• x-slab5-event-id
• x-slab5-event-type
• user-agent: Slab5-Webhooks/1.0

Slab5 queues matching events as delivery records and the outbound delivery worker POSTs each pending or retrying delivery to active endpoints. Successful 2xx responses mark the delivery succeeded; non-2xx responses or network failures are retried with bounded exponential backoff until the endpoint's max attempt count is reached. Paused endpoints are deferred and disabled or archived endpoints are not called.

Delivery retries

Each delivery tracks attempt_count, max_attempts, next_attempt_at, last_status_code, last_error, and signature_header. Failed attempts move to retrying until the configured maximum is reached, then move to failed.

The worker claims a delivery before posting it so overlapping worker runs do not send the same delivery twice. If a worker invocation stops after claiming a delivery but before recording an attempt, the delivery becomes eligible again after the short claim lease expires.