Agent-native Dilnaka Cloud
Webhooks
Domain events can be delivered to external systems with authenticated, replay-resistant payloads.
Signed delivery
Register a public HTTPS endpoint and event selection through the agent API. The signing secret is encrypted at rest and shown only at creation or rotation.
X-Dilnaka-Event-ID: evt_…
X-Dilnaka-Signature: t=1789000000,v1=<hmac-sha256>Verification
Reject stale timestamps, compute HMAC-SHA256 over `<timestamp>.<raw-body>`, and compare in constant time. Persist event IDs to reject replay.
- Default timestamp tolerance: five minutes
- Do not parse or transform the body before verifying
- Return any 2xx status only after durable acceptance
Retries
Non-2xx responses and network failures retry with exponential backoff. Delivery attempts and response summaries are durable. Endpoints disable after repeated failures and can be manually remediated without changing the signing secret.