Automation & Integrations

Webhook Automation

Comprehensive, event-driven webhook automation for VaakLoom. Trigger workflows via inbound webhooks with cryptographic signature verification, and stream real-time events to Slack, Discord, or external APIs with automatic retries and HMAC signing.

Overview: Why Webhook Automation?

Webhooks are the backbone of modern event-driven architectures. VaakLoom provides complete event-driven automation capabilities while maintaining ultra-low latency, 75% memory/compute resource guardrails, and persistent audit telemetry in Anvesh or your chosen database.

Inbound Triggers

Third-Party Ingestion

Expose dedicated endpoints for Stripe, GitHub, Shopify, or custom services. Automatic HMAC signature verification and configurable immediate 202 vs sync execution modes.

Outbound Dispatcher

Event Subscriptions

Subscribe external URLs to system events (e.g. workflow:completed, dlq:created). Includes exponential backoff retries and payload signing.

Anvesh Audit Trail

Zero-Loss Telemetry

Every webhook delivery attempt, latency split, HTTP status code, and payload is audited in Anvesh distributed storage or PostgreSQL/MongoDB.

Inbound Webhook Triggers

Workflows can be triggered directly via HTTP POST/PUT/PATCH webhooks. When enabled, VaakLoom exposes a dedicated endpoint at /webhooks/:workflowId (or a custom path) that bypasses standard API key invoke protection in favor of HMAC signature verification.

Cryptographic Signature Verification

VaakLoom validates signatures using timing-safe comparisons to prevent timing attacks. Built-in header formats include:

GitHub: x-hub-signature-256 (formatted as sha256=<hex>)
Stripe: stripe-signature (formatted as t=<timestamp>,v1=<hex>)
Shopify: x-shopify-hmac-sha256 (Base64-encoded HMAC)
Generic / Custom: x-signature or x-webhook-signature with SHA256 or SHA1

Execution Response Modes

Mode	Status Code	Behavior & Best For
`immediate`	`202 Accepted`	Responds immediately with `{ "acknowledged": true, "runId": "...", "mode": "async" }`, then executes the workflow DAG asynchronously in the background. Prevents 5-second provider timeouts from Stripe and GitHub.
`sync`	`200 OK`	Waits for DAG execution to complete and returns the final transformed response directly to the caller.

Workflow Spec Example

{
  "version": 1,
  "id": "stripe-webhook-handler",
  "name": "Stripe Payment Ingestion",
  "webhook": {
    "enabled": true,
    "path": "/webhooks/stripe-charge",
    "secret": "${env.STRIPE_WEBHOOK_SECRET}",
    "signatureHeader": "stripe-signature",
    "signatureAlgorithm": "sha256",
    "responseMode": "immediate"
  },
  "nodes": [
    {
      "type": "step",
      "step": {
        "id": "notify-fulfillment",
        "kind": "rest",
        "config": {
          "method": "POST",
          "url": "https://erp.internal/orders/fulfill",
          "body": { "chargeId": "${attrs.body.data.object.id}" }
        }
      }
    }
  ]
}

Outbound Webhook Dispatcher

VaakLoom's background Webhook Dispatcher listens to internal system events and streams them to external platforms like Slack, PagerDuty, Zapier, or customer data lakes.

Supported Trigger Events

* — Dispatches all platform events.
workflow:completed — Fired whenever any workflow DAG completes successfully.
workflow:failed — Fired on unhandled workflow failures.
dlq:created — Fired whenever an item fails and is isolated in the Dead Letter Queue.
governor:shed_load — Fired when CPU/Memory limits reach the 75% guardrail.
cicd:deployed — Fired on automated CI/CD deployments.

Security & Signature Header

When an outbound subscription has a configured secret, VaakLoom automatically signs every dispatch payload with HMAC-SHA256 and includes the following headers:

POST /webhook-target HTTP/1.1
Host: hooks.example.com
Content-Type: application/json
User-Agent: VaakLoom-Webhook-Dispatcher/1.0
x-vaakloom-event: workflow:completed
x-vaakloom-delivery: del_99a812bf01
x-vaakloom-signature: sha256=a1b2c3d4e5f6...
x-hub-signature-256: sha256=a1b2c3d4e5f6...

Hub Management & REST API

Webhooks can be created, updated, inspected, and tested directly through the Hub Webhooks UI (/webhooks) or programmatically via the Platform REST API:

Method	Endpoint	Description
`GET`	`/hub/webhooks`	List all registered outbound webhook subscriptions.
`POST`	`/hub/webhooks`	Create a new webhook subscription with events, URL, secret, and max retries.
`GET`	`/hub/webhooks/:id`	Retrieve details for a specific webhook subscription.
`PUT`	`/hub/webhooks/:id`	Update target URL, active status, secret, or subscribed events.
`DELETE`	`/hub/webhooks/:id`	Delete a webhook subscription.
`POST`	`/hub/webhooks/:id/test`	Dispatch an immediate live test ping to verify connectivity and latency.
`GET`	`/hub/webhooks/deliveries`	Query delivery audit log history with optional `subscriptionId` and `status` filters.