After inbox (18 Nov), this post covers webhooks: HMAC signing, at-least-once with receiver dedupe, backoff and DLQ, SSRF-safe URLs, secret rotation, quick-ack receivers, delivery logs and outbox-born fanout versus internal pub/sub.

वेबहुकधर्मः: A Metrical Codification of Webhooks (with English glosses)

What this post is about

Webhooks deliver event notifications as signed HTTP callbacks to external subscriber endpoints.

Topics covered

1. Push vs endless poll
2. HMAC and timestamp signs
3. At-least-once reality
4. Backoff and DLQ
5. SSRF-safe URLs
6. Secret and schema rotation
7. Fast ack async work
8. Per-attempt delivery logs
9. Outbox not request path
10. Pub/sub vs webhook vs inbox

Sanskrit title

वेबहुकधर्मः = vebhuk-dharmaḥ “dharma of webhooks”.

English

Minimizable; Sanskrit-first.

ग्राह्यम् / Keep

१. HMAC+timestamp signatures: reject spoof/replay
२. document at-least-once: receiver idempotent
३. backoff then DLQ: no tight loop
४. allowlist URLs: block SSRF ranges
५. rotate secrets with overlap: schema versions
६. ack fast process async: receiver side
७. enqueue via outbox: not user request path

त्याज्यम् / Avoid

• unsigned webhook trust
• open URL fetch to link-local metadata
• call partner HTTP inside checkout transaction

पदच्छेदः
घटना यदि बहिः पक्षे कथयितव्या तदा पुश मार्गो जायते । वेबहुकधर्मस्तस्माद् बहिःसूचना ॥१॥

Word-for-word

Gloss table

English sense
Webhooks push event HTTP callbacks to subscriber URLs so external systems learn changes without polling forever.

Context / topic
Topic: why webhooks. Distinct from pub/sub inside your mesh and from polling APIs.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
sign payloads HMAC timestamp । unsigned trust मिथ्या ॥२॥

Word-for-word

Gloss table

English sense
Sign bodies with a shared secret and timestamp so receivers reject forgeries and pure replays.

Context / topic
Topic: signing.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
at-least-once + receiver inbox । exactly-once delivery myth ॥३॥

Word-for-word

Gloss table

English sense
Deliver at least once and document idempotent receivers. Promise of perfect once-only HTTP is a myth under retries.

Context / topic
Topic: delivery.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
retry with backoff and give-up DLQ । tight loop receiver burn ॥४॥

Word-for-word

Gloss table

English sense
Retry failed deliveries with exponential backoff then park to a dead store with operator visibility.

Context / topic
Topic: retries.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
SSR F protect receiver URLs allowlist । open URL fetch शस्त्रम् ॥५॥

Word-for-word

Gloss table

English sense
Validate subscriber URLs against private ranges and metadata endpoints. Open webhooks are SSRF guns.

Context / topic
Topic: SSRF.

वृत्तमिति: एकादशाक्षराः पादाः।

पदच्छेदः
subscription versioning and secret rotate । forever one secret ऋणम् ॥६॥

Word-for-word

Gloss table

English sense
Version event schemas and rotate signing secrets with overlap windows so receivers can migrate.

Context / topic
Topic: lifecycle.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
timeout short; async heavy work । receiver long sync hang ॥७॥

Word-for-word

Gloss table

English sense
Receivers should ack quickly and process asynchronously. Long synchronous handlers stall the delivery fleet.

Context / topic
Topic: receiver design.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
delivery logs per attempt status । blind fire अन्धता ॥८॥

Word-for-word

Gloss table

English sense
Persist attempt history for customer support and abuse forensics.

Context / topic
Topic: audit.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
fanout via outbox not request path । sync webhook in API latency ॥९॥

Word-for-word

Gloss table

English sense
Enqueue webhook deliveries from an outbox after commit. Firing partner HTTP inside the user request couples their outage to yours.

Context / topic
Topic: architecture.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
प्रकाशनं internal bus वेबहुक external push । अन्तःपेटिका receiver dedupe ॥१०॥

Word-for-word

Gloss table

English sense
Internal pub/sub is mesh messaging; webhooks are external HTTPS pushes; receivers still need inbox-style dedupe.

Context / topic
Topic: series distinctions.

सन्धिः: प्रकाशन अभ्यन्तर; हुक बहिःHTTPS; पेटिका द्विःमा।

वृत्तमिति: एकादशाक्षराः पादाः।

पदच्छेदः
sign retry SSRF rotate async-outbox पञ्चकम् । एभिर्वेबहुकधर्मो बहिःसूचनासमन्वितः ॥११॥

Word-for-word

Gloss table

English sense
Five limbs: signed payloads, backoff retries with DLQ, SSRF-safe URLs, secret and schema rotation and outbox-born async delivery.

Context / topic
Topic: checklist.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
इति वेबहुकधर्मसारो बहिःसूचनासमन्वितः । मितं बहिःपुशं क्रियायोग्यं तन्त्रधर्मः स उच्यते ॥१२॥

Word-for-word

Gloss table

English sense
Closing: push outward with signatures, patience and no open SSRF doors.

Context / topic
Topic: close.

उपसंहारन्यायः: चिह्नं देहि; पुनर्प्रयतस्व मितम्; URLं रक्ष।

वृत्तमिति: ८-८-८-८।

१. Why webhooks
२. Signing
३. Delivery
४. Retries
५. SSRF
६. Rotate
७. Receiver
८. Logs
९. Outbox path
१०. Series
११. Five limbs
१२. Close

1. Prior: inbox 2026-11-18; outbox 2026-09-28; pub/sub 2026-10-26.
2. Domain: webhooks.
3. English minimizable; Sanskrit-first.
4. Style: no em dash; no Oxford comma in English clauses.