{"uid":"cap_mK8PrSBDgZ4fpspRDZ32T","slug":"webhook-delivery-resilience-audit-c54b36a4","name":"Webhook Delivery Resilience Audit","description":"Public static preview plus paid token controls, risk consensus, AI security, webhook reliability, developer security, schedule risk, decision analysis, API release compatibility, accounts-payable reconciliation, e-commerce return eligibility, SaaS subscription-proration, sales-commission reconciliation, parcel-charge reconciliation, SLA service-credit reconciliation, advertising spend-and-fee audit, contract-renewal audit, workforce timecard reconciliation, hotel booking-commission reconciliation, and warehouse cycle-count adjustment reconciliation products for autonomous agents.","url":"https://rooke-token-risk-pilot.rookepoole.workers.dev/v1/x402/webhook-resilience-audit?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"retry":{"type":"object","required":["maximumAttempts","delaysSeconds","jitterEnabled","honorsRetryAfter"],"properties":{"delaysSeconds":{"type":"array","items":{"type":"integer","maximum":86400,"minimum":0},"maxItems":19},"jitterEnabled":{"type":"boolean"},"maximumAttempts":{"type":"integer","maximum":20,"minimum":1},"honorsRetryAfter":{"type":"boolean"}},"additionalProperties":false},"delivery":{"type":"object","required":["requestTimeoutSeconds","idempotentConsumer","deadLetterHandling","orderedDeliveryRequired","maximumConcurrency"],"properties":{"deadLetterHandling":{"enum":["QUEUE","PERSIST","DROP","NONE"],"type":"string"},"idempotentConsumer":{"type":"boolean"},"maximumConcurrency":{"type":"integer","maximum":1000,"minimum":1},"requestTimeoutSeconds":{"type":"integer","maximum":300,"minimum":1},"orderedDeliveryRequired":{"type":"boolean"}},"additionalProperties":false},"signature":{"type":"object","required":["scheme","signatureHeader","timestampHeader","maximumAgeSeconds"],"properties":{"scheme":{"enum":["HMAC_SHA256","ED25519","OTHER","NONE"],"type":"string"},"signatureHeader":{"anyOf":[{"type":"string","pattern":"^[A-Za-z0-9-]+$","maxLength":128,"minLength":1},{"type":"null"}]},"timestampHeader":{"anyOf":[{"type":"string","pattern":"^[A-Za-z0-9-]+$","maxLength":128,"minLength":1},{"type":"null"}]},"maximumAgeSeconds":{"anyOf":[{"type":"integer","maximum":86400,"minimum":1},{"type":"null"}]}},"additionalProperties":false},"transport":{"enum":["HTTPS","HTTP"],"type":"string"},"eventIdHeader":{"anyOf":[{"type":"string","pattern":"^[A-Za-z0-9-]+$","maxLength":128,"minLength":1},{"type":"null"}]}}},"responseSchema":{"type":"json","example":{"scores":{"overall":100,"security":100,"reliability":100},"verdict":"RESILIENT_DECLARED_POLICY","findings":[],"riskFlags":[],"reportHash":"sha256-hex","evidenceGaps":["DECLARED_POLICY_NOT_RUNTIME_VERIFIED"],"derivedPolicy":{},"schemaVersion":"WEBHOOK_DELIVERY_RESILIENCE_AUDIT_V1"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_hOsmeewPGHI4vfgJ2ZTP3","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Audits a webhook configuration for delivery resilience, scoring its retry logic, security, and reliability posture against best practices.","exampleAgentPrompt":"Audit my webhook delivery config: HTTPS transport, up to 5 retry attempts with delays of 1, 5, 30, 60, 300 seconds and jitter enabled, honors Retry-After headers, 30-second request timeout, idempotent consumer, QUEUE dead-letter handling, ordered delivery not required, max concurrency 10, HMAC_SHA256 signature on header X-Signature with timestamp header X-Timestamp and max age 300 seconds, and event ID header X-Event-ID — give me the resilience scores and any risk flags.","exampleUseCases":[{"title":"Pre-launch webhook resilience check","prompt":"Before I go live, audit my webhook config: HTTPS transport, 3 max retry attempts with delays of 5 and 30 seconds and jitter on, honors Retry-After, HMAC_SHA256 signatures on X-Hub-Signature with X-Timestamp header and 60 second max age, 10 second request timeout, idempotent consumer, PERSIST dead-letter handling, max concurrency 5, ordered delivery not required — tell me the overall resilience score and any findings."},{"title":"Security posture review for event pipeline","prompt":"I want to check how secure my webhook receiver is — it uses HTTPS, ED25519 signing on the header X-Webhook-Sig with a timestamp in X-Timestamp and max age 120 seconds, no event ID header, 60 second timeout, non-idempotent consumer, DROP dead-letter handling, max concurrency 50, 2 max retries with a 10 second delay, no jitter, doesn't honor Retry-After. What's the security score and what risk flags come back?"},{"title":"Reliability audit for payment event webhooks","prompt":"Audit the reliability of my payment webhook setup: HTTPS, up to 10 retry attempts with delays of 1, 2, 5, 10, 30, 60, 120, 300, 600, 1800 seconds, jitter enabled, honors Retry-After, 45 second timeout, idempotent consumer, QUEUE dead-letter handling, ordered delivery required, max concurrency 1, HMAC_SHA256 on X-Signature with X-Timestamp and 300 second max age, event ID header X-Idempotency-Key — what's the verdict and are there any evidence gaps?"}],"resultDescription":"Returns a JSON object with numeric scores (overall, security, reliability each 0-100), a verdict string (e.g. RESILIENT_DECLARED_POLICY), a list of findings, a list of risk flags, a SHA-256 report hash, evidence gaps noting what was declared vs. runtime-verified, a derived policy summary, and a schema version identifier.","failureModes":["Missing required fields in retry, delivery, or signature objects returns a 400 validation error","Invalid enum values (e.g. unknown dead-letter handling or signature scheme) return a 400 error","Payment of 0.05 USDC not provided or rejected returns a 402 Payment Required response","Transport set to HTTP (non-HTTPS) may trigger low security scores rather than an error","Overly large delay arrays (>19 items) or out-of-range integers cause schema validation failure"],"whenToPreferThis":"Choose this endpoint when you need a structured, scored audit of a webhook delivery configuration's resilience — specifically covering retry logic, signature verification, dead-letter handling, idempotency, and timeout settings. It is ideal for pre-launch validation, security posture reviews, or compliance checks on event-driven pipelines. Prefer it over generic API testing tools when you need an opinionated, scored verdict with explicit risk flags and evidence gap annotations.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T06:37:17.972Z","isFirstParty":false,"canonicalSlug":"webhook-delivery-resilience-audit-c54b36a4"}