Webhooks

SendPromptly can fan out one event to multiple webhook endpoints.

Delivery rules

• One delivery run per endpoint
• Success is HTTP 2xx
• Retries use exponential backoff

Signature headers

Validate these headers before processing:

• X-SP-Timestamp
• X-SP-Signature

Use HMAC-SHA256 over the raw request body and compare signatures in constant time.