Real-Time APIs · Capstone
Capstone: Build a Webhook Platform
Design outbound webhooks for a SaaS with 20,000 customer endpoints.
Scenario
Your SaaS emits 30 event types. 20,000 customers register endpoints; some are slow or down for days; a few customers receive 1M events/day. Customers complain about missed events and can't debug failures.
Requirements
- Reliable at-least-once delivery
- One slow customer never delays others
- Self-service debugging and replay
- Secure delivery
Constraints
- Events must be delivered within 1 minute for healthy endpoints
Deliverables
- Design the delivery pipeline and isolation.
- Security and developer experience.
Draft each deliverable below before revealing the model answer and rubric.
Further reading: Standard Webhooks
Deliverables
Design the delivery pipeline and isolation.
Model answer
Outbox → event bus → fan-out service creates delivery tasks per subscribed endpoint → per-endpoint queues (or partitioned by endpoint) with concurrency limits → workers POST with 10 s timeout. Retries with exponential backoff over ~3 days; circuit breaker per endpoint; auto-disable after sustained failures + email. High-volume customers get dedicated partitions/workers.
Rubric
Isolation per endpoint is the key insight.
Security and developer experience.
Model answer
Standard Webhooks headers and HMAC signatures with rotation; HTTPS only; SSRF protection (resolve + block private ranges, no redirects); dashboard with delivery logs, payloads, response codes, manual resend, test events; events API for backfill; documented retry schedule and no-ordering guarantee.
Rubric
Look for SSRF protection and self-service recovery tools.
Open in the app to mark lessons complete, take notes and track your progress.