Webhooks: events that do not get lost
Issuance, verification, escalation, revocation: every event is queued in the same database transaction as the business change (transactional outbox) — there is no state in which the change applies but the event is missing.
Persistent delivery
Retries after 30 seconds, 2, 8 and 32 minutes and 2 hours; then the dead-letter queue. A circuit breaker protects the receiver from an avalanche when it is temporarily down.
Signed
Every delivery is signed with HMAC. The receiver checks the signature before trusting the event.
For every event
Previously verification.escalated still ran on the side and to the wrong organisation. Since the correction the outbox applies to all trust events — proven by SQL tests.
Status
Part of the platform; outbox for all events (migrations 033, 046).